RT2772: accept empty SessionTicket
authorEmilia Kasper <emilia@openssl.org>
Wed, 23 Sep 2015 17:29:18 +0000 (19:29 +0200)
committerEmilia Kasper <emilia@openssl.org>
Mon, 28 Sep 2015 14:07:00 +0000 (16:07 +0200)
commit21b538d616b388fa0ce64ef54da3504253895cf8
tree9071ff76e13e1abe67fe997572b033588ffa0ea3
parent92ea6fe597238779e23fd9e1fee82d30641d61a8
RT2772: accept empty SessionTicket

RFC 5077 section 3.3 says: If the server determines that it does not
want to include a ticket after it has included the SessionTicket
extension in the ServerHello, then it sends a zero-length ticket in the
NewSessionTicket handshake message.

Previously the client would fail upon attempting to allocate a
zero-length buffer. Now, we have the client ignore the empty ticket and
keep the existing session.

Reviewed-by: Matt Caswell <matt@openssl.org>
ssl/s3_clnt.c