Never send a session id in TLS1.3
authorMatt Caswell <matt@openssl.org>
Fri, 13 Jan 2017 13:49:44 +0000 (13:49 +0000)
committerMatt Caswell <matt@openssl.org>
Mon, 30 Jan 2017 10:17:52 +0000 (10:17 +0000)
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2259)

ssl/statem/statem_clnt.c

index 45177ec..d5d622c 100644 (file)
@@ -1003,7 +1003,7 @@ int tls_construct_client_hello(SSL *s, WPACKET *pkt)
     }
 
     /* Session ID */
-    if (s->new_session)
+    if (s->new_session || s->session->ssl_version == TLS1_3_VERSION)
         sess_id_len = 0;
     else
         sess_id_len = s->session->session_id_length;