[gnutls-devel] GnuTLS | Fix non-empty session id (TLS13_APPENDIX_D4) (!1350)

[Read-only notification of GnuTLS library development activities]

Daiki Ueno started a new discussion on lib/handshake.c: https://gitlab.com/gnutls/gnutls/-/merge_requests/1350#note_444687501

>  
>  #ifdef TLS13_APPENDIX_D4
>  		if (max_ver->tls13_sem &&
> -		    session->security_parameters.session_id_size == 0) {
> +		    session->internals.resumed_security_parameters.session_id_size == 0) {
>  
>  			/* Under TLS1.3 we generate a random session ID to make
>  			 * the TLS1.3 session look like a resumed TLS1.2 session */
> -			ret = _gnutls_generate_session_id(session->security_parameters.
> +			ret = _gnutls_generate_session_id(session->internals.resumed_security_parameters.

While it seemed like a good idea to actually reuse the `resumed_security_parameters`, it actually confuses the TLS 1.3 client as the first connection is seen as a resumed session (see the failure in `tls13-resume-x509`).

I suppose on the way to avoid this is to use the local variables to temporarily store the generated session ID and its length.

Also note that, as the presence of session ID in Client Hello affects the transcript hash, you might need to update `tests/tls13/prf.c`.

-- 
Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/merge_requests/1350#note_444687501
You're receiving this email because of your account on gitlab.com.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.gnupg.org/pipermail/gnutls-devel/attachments/20201110/b951c4ed/attachment-0001.html>