there is no minimum length for session IDs

PR: 274

diff --git a/CHANGES b/CHANGES
index 0cfe8adc9be79fcd4575aecaebf589139ac39ec7..b2176628401de35e6bcb6fd3f473736e189e4b32 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1923,6 +1923,10 @@ des-cbc           3624.96k     5258.21k     5530.91k     5624.30k     5628.26k
 
  Changes between 0.9.6g and 0.9.6h  [xx XXX xxxx]
 
+  *) Don't impose a 16-byte length minimum on session IDs in ssl/s3_clnt.c
+     (the SSL 3.0 and TLS 1.0 specifications allow any length up to 32 bytes).
+     [Bodo Moeller]
+
   *) Fix race condition in SSLv3_client_method().
      [Bodo Moeller]
 

diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c
index ca15881eaf2713e20e887a9fe05b9789fe6be4a3..578eca457a2ae1bb8b1e7433b1840a7be7e88754 100644 (file)
--- a/ssl/s3_clnt.c
+++ b/ssl/s3_clnt.c
@@ -671,23 +671,11 @@ static int ssl3_get_server_hello(SSL *s)
        /* get the session-id */
        j= *(p++);
 
-       if(j > sizeof s->session->session_id)
-               {
-               al=SSL_AD_ILLEGAL_PARAMETER;
-               SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,
-                      SSL_R_SSL3_SESSION_ID_TOO_LONG);
-               goto f_err;
-               }
-
-       if ((j != 0) && (j != SSL3_SESSION_ID_SIZE))
+       if ((j > sizeof s->session->session_id) || (j > SSL3_SESSION_ID_SIZE))
                {
-               /* SSLref returns 16 :-( */
-               if (j < SSL2_SSL_SESSION_ID_LENGTH)
-                       {
-                       al=SSL_AD_ILLEGAL_PARAMETER;
-                       SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_SSL3_SESSION_ID_TOO_SHORT);
-                       goto f_err;
-                       }
+               al=SSL_AD_ILLEGAL_PARAMETER;
+               SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_SSL3_SESSION_ID_TOO_LONG);
+               goto f_err;
                }
        if (j != 0 && j == s->session->session_id_length
            && memcmp(p,s->session->session_id,j) == 0)
@@ -695,6 +683,7 @@ static int ssl3_get_server_hello(SSL *s)
            if(s->sid_ctx_length != s->session->sid_ctx_length
               || memcmp(s->session->sid_ctx,s->sid_ctx,s->sid_ctx_length))
                {
+               /* actually a client application bug */
                al=SSL_AD_ILLEGAL_PARAMETER;
                SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_ATTEMPT_TO_REUSE_SESSION_IN_DIFFERENT_CONTEXT);
                goto f_err;