tree ea9c90510eb286eafd0db882e6c0333f1c48a625
parent 7935b51b8b5cbc07f572a28dc2f82e03e5fcb449
author Andrew Gerrand <adg@golang.org> 1411684340 +0000
committer Andrew Gerrand <adg@golang.org> 1411684340 +0000
golang-hg eae0457c101512f59296538f0162749eba325892

[release-branch.go1.3] crypto/tls: ensure that we don't resume when tickets are disabled

A security bug affects programs that use crypto/tls to implement a TLS server
from Go 1.1 onwards. If the server enables TLS client authentication using
certificates (this is rare) and explicitly sets SessionTicketsDisabled to true
in the tls.Config, then a malicious client can falsely assert ownership of any
client certificate it wishes.

This issue was discovered internally and there is no evidence of exploitation.

Change authored by Adam Langley <agl@golang.org>
https://golang.org/cl/148080043/