{"schema":"libjg2-1", "vpath":"/git/", "avatar":"/git/avatar/", "alang":"", "gen_ut":1752649381, "reponame":"openssl", "desc":"OpenSSL", "owner": { "name": "Andy Green", "email": "andy@warmcat.com", "md5": "c50933ca2aa61e0fe2c43d46bb6b59cb" },"url":"https://warmcat.com/repo/openssl", "f":3, "items": [ {"schema":"libjg2-1", "cid":"749b30f3fcb319d1ab37d9c328e1c360", "commit": {"type":"commit", "time": 1493221349, "time_ofs": 60, "oid_tree": { "oid": "c512f5e2451f1463b098296ebcfa7088f8d51e1a", "alias": []}, "oid":{ "oid": "150840b9443d371bfa26e2a33051aa137b5606fc", "alias": []}, "msg": "Always duplicate the session on NewSessionTicket in TLSv1.3", "sig_commit": { "git_time": { "time": 1493221349, "offset": 60 }, "name": "Matt Caswell", "email": "matt@openssl.org", "md5": "10f7b441a32d5790efad9fc68cae4af2" }, "sig_author": { "git_time": { "time": 1490268146, "offset": 0 }, "name": "Matt Caswell", "email": "matt@openssl.org", "md5": "10f7b441a32d5790efad9fc68cae4af2" }}, "body": "Always duplicate the session on NewSessionTicket in TLSv1.3\n\nBecause NST messages arrive post-handshake, the session may have already\ngone into the cache. Once in the cache a session must be immutable -\notherwise you could get multi-thread issues.\n\nReviewed-by: Rich Salz \u003crsalz@openssl.org\u003e\n(Merged from https://github.com/openssl/openssl/pull/3008)" , "diff": "diff --git a/ssl/statem/statem_clnt.c b/ssl/statem/statem_clnt.c\nindex 56c315e..ab77ba0 100644\n--- a/ssl/statem/statem_clnt.c\n+++ b/ssl/statem/statem_clnt.c\n@@ -2438,7 +2438,15 @@ MSG_PROCESS_RETURN tls_process_new_session_ticket(SSL *s, PACKET *pkt)\n if (ticklen \u003d\u003d 0)\n return MSG_PROCESS_CONTINUE_READING;\n \n- if (s-\u003esession-\u003esession_id_length \u003e 0) {\n+ /*\n+ * Sessions must be immutable once they go into the session cache. Otherwise\n+ * we can get multi-thread problems. Therefore we don't \u0022update\u0022 sessions,\n+ * we replace them with a duplicate. In TLSv1.3 we need to do this every\n+ * time a NewSessionTicket arrives because those messages arrive\n+ * post-handshake and the session may have already gone into the session\n+ * cache.\n+ */\n+ if (SSL_IS_TLS13(s) || s-\u003esession-\u003esession_id_length \u003e 0) {\n int i \u003d s-\u003esession_ctx-\u003esession_cache_mode;\n SSL_SESSION *new_sess;\n /*\n","s":{"c":1752649381,"u": 58028}} ],"g": 59031,"chitpc": 0,"ehitpc": 0,"indexed":0 , "ab": 0, "si": 0, "db":0, "di":0, "sat":0, "lfc": "0000"}