Always require an advertised NewSessionTicket message.
authorEmilia Kasper <emilia@openssl.org>
Wed, 19 Nov 2014 15:40:27 +0000 (16:40 +0100)
committerEmilia Kasper <emilia@openssl.org>
Thu, 20 Nov 2014 13:57:15 +0000 (14:57 +0100)
commitde2c7504ebd4ec15334ae151a31917753468f86f
tree851523cb1d61f74403e9ef4394d92a069ac9032a
parent980bc1ec6114f5511b20c2e6ca741e61a39b99d6
Always require an advertised NewSessionTicket message.

The server must send a NewSessionTicket message if it advertised one
in the ServerHello, so make a missing ticket message an alert
in the client.

An equivalent change was independently made in BoringSSL, see commit
6444287806d801b9a45baf1f6f02a0e3a16e144c.

Reviewed-by: Matt Caswell <matt@openssl.org>
CHANGES
ssl/s3_clnt.c