Fix from HEAD.

diff --git a/ssl/s3_srvr.c b/ssl/s3_srvr.c
index a686718b3619ebe8e90f84334d1a921ce772d51e..b83a8d7da4be05b350431cc0d3b9c18c4613654a 100644 (file)
--- a/ssl/s3_srvr.c
+++ b/ssl/s3_srvr.c
@@ -1115,8 +1115,16 @@ int ssl3_send_server_hello(SSL *s)
                 * session-id if we want it to be single use.
                 * Currently I will not implement the '0' length session-id
                 * 12-Jan-98 - I'll now support the '0' length stuff.
                 * session-id if we want it to be single use.
                 * Currently I will not implement the '0' length session-id
                 * 12-Jan-98 - I'll now support the '0' length stuff.

+                *
+                * We also have an additional case where stateless session
+                * resumption is successful: we always send back the old
+                * session id. In this case s->hit is non zero: this can
+                * only happen if stateless session resumption is succesful
+                * if session caching is disabled so existing functionality
+                * is unaffected.

                 */
                 */

-               if (!(s->ctx->session_cache_mode & SSL_SESS_CACHE_SERVER))
+               if (!(s->ctx->session_cache_mode & SSL_SESS_CACHE_SERVER)
+                       && !s->hit)

                        s->session->session_id_length=0;
 
                sl=s->session->session_id_length;
                        s->session->session_id_length=0;
 
                sl=s->session->session_id_length;