Max/XTLS_REALITY
1
0
Fork 0
mirror of https://github.com/XTLS/REALITY.git synced 2026-10-07 06:18:06 +03:00
Code Issues Packages Projects Releases Wiki Activity

crypto/tls: add verifiedChains expiration checking during resumption

Browse Source 
When resuming a session, check that the verifiedChains contain at least
one chain that is still valid at the time of resumption. If not, trigger
a new handshake.

Updates #77113
Updates #77217
Updates CVE-2025-68121

Change-Id: I14f585c43da17802513cbdd5b10c552d7a38b34e
Reviewed-on: https://go-review.googlesource.com/c/go/+/739321
Reviewed-by: Coia Prant <coiaprant@gmail.com>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
Auto-Submit: Roland Shoemaker <roland@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
This commit is contained in:
yuhan6665
2026-09-08 21:33:46 -04:00
parent 7103a0cf07
commit f07a54079c
4 changed files with 22 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
handshake_server.go
+1 -1
View File
@@ -511,7 +511,7 @@ func (hs *serverHandshakeState) checkForResumption() error {
return nil
}
if sessionHasClientCerts && c.config.ClientAuth >= VerifyClientCertIfGiven &&
len(sessionState.verifiedChains) == 0 {
!anyUnexpiredChain(sessionState.verifiedChains, c.config.time()) {
return nil
}