Changeset 796d9a3 in mod_gnutls for src

Timestamp:

Jun 6, 2020, 8:06:05 AM (7 months ago)

Author:

Fiona Klute <fiona.klute@…>

Branches:

asyncio, master

Children:

4f39196

Parents:

e6d9e47

Message:

Cache session tickets for proxy connections only when using TLS 1.3

TLS 1.3 provides forward secrecy for resumed sessions, TLS 1.2 does
not. The check has to happen before the check for
GNUTLS_SFLAGS_SESSION_TICKET because that flag doesn't seem to get set
for TLS 1.2 sessions, which would lead to misleading error
messages. The check for a cache comes first because it is the most
simple one.

File:

• src/gnutls_proxy.c (modified) (2 diffs)

src/gnutls_proxy.c

@@ -309 +309 @@
 
     mgs_handle_t *ctxt = gnutls_session_get_ptr(session);
+
+    /* No cache means we cannot cache tickets. */
+    if (!ctxt->sc->cache_enable)
+        return GNUTLS_E_SUCCESS;
+
+    if (gnutls_protocol_get_version(ctxt->session) != GNUTLS_TLS1_3)
+    {
+        ap_log_cerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, ctxt->c,
+                      "%s: session tickets for proxy connections are used "
+                      "only with TLS 1.3.", __func__);
+        return GNUTLS_E_SUCCESS;
+    }
+
     if (!(gnutls_session_get_flags(session) & GNUTLS_SFLAGS_SESSION_TICKET))
     {
@@ -318 +331 @@
         return GNUTLS_E_SUCCESS;
     }
-
-    /* No cache means we cannot cache tickets. */
-    if (!ctxt->sc->cache_enable)
-        return GNUTLS_E_SUCCESS;
 
     gnutls_datum_t ticket;