{"schema":"libjg2-1", "vpath":"/git/", "avatar":"/git/avatar/", "alang":"", "gen_ut":1752991471, "reponame":"openssl", "desc":"OpenSSL", "owner": { "name": "Andy Green", "email": "andy@warmcat.com", "md5": "c50933ca2aa61e0fe2c43d46bb6b59cb" },"url":"https://warmcat.com/repo/openssl", "f":3, "items": [ {"schema":"libjg2-1", "cid":"f78668dac1e22dec93efad0802b48da0", "commit": {"type":"commit", "time": 1485771472, "time_ofs": 0, "oid_tree": { "oid": "1304c4303edeb83afba1fa0952e5c5063c17c23d", "alias": []}, "oid":{ "oid": "e7a28df70bcf8677df6c5270eff8bbe8858b8fe9", "alias": []}, "msg": "Add a TODO around handling of SSL_get_session() and SSL_get1_session()", "sig_commit": { "git_time": { "time": 1485771472, "offset": 0 }, "name": "Matt Caswell", "email": "matt@openssl.org", "md5": "10f7b441a32d5790efad9fc68cae4af2" }, "sig_author": { "git_time": { "time": 1484314489, "offset": 0 }, "name": "Matt Caswell", "email": "matt@openssl.org", "md5": "10f7b441a32d5790efad9fc68cae4af2" }}, "body": "Add a TODO around handling of SSL_get_session() and SSL_get1_session()\n\nThese functions are problematic in TLSv1.3 because the server sends the\nNewSessionTicket message after the handshake has finished.\n\nReviewed-by: Rich Salz \u003crsalz@openssl.org\u003e\n(Merged from https://github.com/openssl/openssl/pull/2259)" , "diff": "diff --git a/ssl/ssl_sess.c b/ssl/ssl_sess.c\nindex c6d5c12..0d9bd7a 100644\n--- a/ssl/ssl_sess.c\n+++ b/ssl/ssl_sess.c\n@@ -44,6 +44,15 @@ static void SSL_SESSION_list_remove(SSL_CTX *ctx, SSL_SESSION *s);\n static void SSL_SESSION_list_add(SSL_CTX *ctx, SSL_SESSION *s);\n static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck);\n \n+/*\n+ * TODO(TLS1.3): SSL_get_session() and SSL_get1_session() are problematic in\n+ * TLS1.3 because, unlike in earlier protocol versions, the session ticket\n+ * may not have been sent yet even though a handshake has finished. The session\n+ * ticket data could come in sometime later...or even change if multiple session\n+ * ticket messages are sent from the server. We need to work out how to deal\n+ * with this.\n+ */\n+\n SSL_SESSION *SSL_get_session(const SSL *ssl)\n /* aka SSL_get0_session; gets 0 objects, just returns a copy of the pointer */\n {\n","s":{"c":1752923810,"u": 27639}} ],"g": 738,"chitpc": 0,"ehitpc": 0,"indexed":0 , "ab": 0, "si": 0, "db":0, "di":0, "sat":0, "lfc": "7d0a"}