Tighten session ticket handling

[openssl.git] / ssl / ssl_sess.c

diff --git a/ssl/ssl_sess.c b/ssl/ssl_sess.c
index 90f92b2d11fa4927e8719a938448f74290408f15..3f9bad10a4d3769df4b6bb7eacfcdef45ed355db 100644 (file)
--- a/ssl/ssl_sess.c
+++ b/ssl/ssl_sess.c
@@ -340,7 +340,21 @@ int ssl_get_new_session(SSL *s, int session)
                        return(0);
                        }
 #ifndef OPENSSL_NO_TLSEXT
-               /* If RFC4507 ticket use empty session ID */
+               /*
+                * If RFC5077 ticket, use empty session ID (as server).
+                * Note that:
+                * (a) ssl_get_prev_session() does lookahead into the
+                *     ClientHello extensions to find the session ticket.
+                *     When ssl_get_prev_session() fails, s3_srvr.c calls
+                *     ssl_get_new_session() in ssl3_get_client_hello().
+                *     At that point, it has not yet parsed the extensions,
+                *     however, because of the lookahead, it already knows
+                *     whether a ticket is expected or not.
+                *
+                * (b) s3_clnt.c calls ssl_get_new_session() before parsing
+                *     ServerHello extensions, and before recording the session
+                *     ID received from the server, so this block is a noop.
+                */
                if (s->tlsext_ticket_expected)
                        {
                        ss->session_id_length = 0;
@@ -746,8 +760,6 @@ void SSL_SESSION_free(SSL_SESSION *ss)
        ss->tlsext_ellipticcurvelist_length = 0;
        if (ss->tlsext_ellipticcurvelist != NULL) OPENSSL_free(ss->tlsext_ellipticcurvelist);
 #endif /* OPENSSL_NO_EC */
-       if (ss->audit_proof != NULL) OPENSSL_free(ss->audit_proof);
-       ss->audit_proof_length = 0;
 #endif
 #ifndef OPENSSL_NO_PSK
        if (ss->psk_identity_hint != NULL)
@@ -869,15 +881,6 @@ int SSL_SESSION_set1_id_context(SSL_SESSION *s,const unsigned char *sid_ctx,
        return 1;
        }
 
-#ifndef OPENSSL_NO_TLSEXT
-unsigned char *SSL_SESSION_get_tlsext_authz_server_audit_proof(SSL_SESSION *s, size_t *proof_length)
-       {
-       if (s->audit_proof != NULL)
-               *proof_length = s->audit_proof_length;
-       return s->audit_proof;
-       }
-#endif
-
 long SSL_CTX_set_timeout(SSL_CTX *s, long t)
        {
        long l;