[openssl/openssl] 39a43f: Skip the legacy session ID check for DTLS 1.3 resu...

  Branch: refs/heads/feature/dtls-1.3
  Home:   https://github.com/openssl/openssl
  Commit: 39a43f7ff92f7c2ae969412bbc25e5e958e8ee50
      https://github.com/openssl/openssl/commit/39a43f7ff92f7c2ae969412bbc25e5e958e8ee50
  Author: Ryan Hooper <[email protected]>
  Date:   2026-08-21 (Fri, 21 Aug 2026)

  Changed paths:
    M ssl/ssl_sess.c
    M test/recipes/70-test_dtls13ack.t
    M test/recipes/70-test_dtls13epoch.t
    A test/recipes/70-test_dtls13sessionid.t

  Log Message:
  -----------
  Skip the legacy session ID check for DTLS 1.3 resumption

Commit 4e8593e7ebbb added a session ID match in ssl_get_prev_session()
guarded by !SSL_CONNECTION_IS_TLS13(s). That macro excludes DTLS, so
the pre-1.3 check wrongly ran for DTLS 1.3, where legacy_session_id is
a meaningless compatibility field.

OpenSSL DTLS 1.3 clients send an empty legacy_session_id, so this went
unnoticed. Peers that send a non-empty one (e.g. wolfSSL) tripped the
mismatch and were refused resumption. Use SSL_CONNECTION_IS_VERSION13(s),
which covers both TLS 1.3 and DTLS 1.3.

Add a DTLS 1.3 TLSProxy test that injects a mismatching
legacy_session_id and confirms the server still resumes.

Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
Merge-date: Fri Aug 21 18:24:12 2026
Merged-from: https://github.com/openssl/openssl/pull/32435



To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/feature/dtls-1.3/d856fe-39a43f%40github.com.