From: Lutz Jänicke <jaenicke@openssl.org>
Date: Wed, 15 Jan 2003 09:51:22 +0000 (+0000)
Subject: Really fix SSLv2 session ID handling
X-Git-Tag: BEN_FIPS_TEST_1~38^2~390
X-Git-Url: https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff_plain;h=8ec16ce7110a9b60bb6a616c4f0ad2df6cb08894

Really fix SSLv2 session ID handling

PR: 377
---

diff --git a/CHANGES b/CHANGES
index 4b11fc9c53..c3176727e5 100644
--- a/CHANGES
+++ b/CHANGES
@@ -375,6 +375,15 @@ TODO: bug: pad  x  with leading zeros if necessary
  
  Changes between 0.9.7 and 0.9.7a  [XX xxx 2003]
 
+  *) Another fix for SSLv2 session ID handling: the session ID was incorrectly
+     checked on reconnect on the client side, therefore session resumption
+     could still fail with a "ssl session id is different" error. This
+     behaviour is masked when SSL_OP_ALL is used due to
+     SSL_OP_MICROSOFT_SESS_ID_BUG being set.
+     Behaviour observed by Crispin Flowerday <crispin@flowerday.cx> as
+     followup to PR #377.
+     [Lutz Jaenicke]
+
   *) IA-32 assembler support enhancements: unified ELF targets, support
      for SCO/Caldera platforms, fix for Cygwin shared build.
      [Andy Polyakov]
diff --git a/ssl/s2_clnt.c b/ssl/s2_clnt.c
index c6319bb63d..1d24dedc91 100644
--- a/ssl/s2_clnt.c
+++ b/ssl/s2_clnt.c
@@ -1021,7 +1021,7 @@ static int get_server_finished(SSL *s)
 		if (!(s->options & SSL_OP_MICROSOFT_SESS_ID_BUG))
 			{
 			if ((s->session->session_id_length > sizeof s->session->session_id)
-			    || (0 != memcmp(buf, s->session->session_id,
+			    || (0 != memcmp(buf + 1, s->session->session_id,
 			                    (unsigned int)s->session->session_id_length)))
 				{
 				ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);