[openssl-commits] [openssl] master update
Matt Caswell
matt at openssl.org
Thu Jun 7 10:05:11 UTC 2018
The branch master has been updated
via 10bda8f8dd359b3db39a5157be0e72afe9f05eea (commit)
via 6cf2dbd9faffbed52a6bede924fe0a93345b8bfa (commit)
via 4ff1a5266685f4a687a9f91b531c2f979b96db22 (commit)
from 309371d6266877a8f04d0aa7b0f6add6d269d962 (commit)
- Log -----------------------------------------------------------------
commit 10bda8f8dd359b3db39a5157be0e72afe9f05eea
Author: Matt Caswell <matt at openssl.org>
Date: Thu Jun 7 10:00:44 2018 +0100
Reformulate the if condition in tls_process_new_session_ticket
Improves readability
Reviewed-by: Andy Polyakov <appro at openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6415)
commit 6cf2dbd9faffbed52a6bede924fe0a93345b8bfa
Author: Matt Caswell <matt at openssl.org>
Date: Tue Jun 5 12:23:28 2018 +0100
Don't store the ticket nonce in the session
We generate the secrets based on the nonce immediately so there is no
need to keep the nonce.
Reviewed-by: Andy Polyakov <appro at openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6415)
commit 4ff1a5266685f4a687a9f91b531c2f979b96db22
Author: Matt Caswell <matt at openssl.org>
Date: Fri Jun 1 16:52:34 2018 +0100
Fix TLSv1.3 ticket nonces
All tickets on a connection need to have a unique nonce. When this was
originally implemented we only ever sent one ticket on the conneciton so
this didn't matter. We were just using the value 0. Now we can get multiple
tickets to we need to start doing the ticket nonce properly.
Fixes #6387
Reviewed-by: Andy Polyakov <appro at openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6415)
-----------------------------------------------------------------------
Summary of changes:
include/openssl/ssl.h | 1 -
ssl/ssl_asn1.c | 24 +++-----------------
ssl/ssl_locl.h | 14 +++++++-----
ssl/ssl_sess.c | 9 --------
ssl/statem/extensions.c | 35 +++++++++--------------------
ssl/statem/statem_clnt.c | 38 +++++++++++++++++++++++++++-----
ssl/statem/statem_srvr.c | 57 +++++++++++++++++++++++++++++++++++-------------
ssl/tls13_enc.c | 3 +--
test/session.pem | 18 +++++++--------
9 files changed, 105 insertions(+), 94 deletions(-)
diff --git a/include/openssl/ssl.h b/include/openssl/ssl.h
index db0a2d5..280250a 100644
--- a/include/openssl/ssl.h
+++ b/include/openssl/ssl.h
@@ -48,7 +48,6 @@ extern "C" {
# define SSL_MIN_RSA_MODULUS_LENGTH_IN_BYTES (512/8)
# define SSL_MAX_KEY_ARG_LENGTH 8
# define SSL_MAX_MASTER_KEY_LENGTH 48
-# define TLS13_MAX_RESUMPTION_MASTER_LENGTH 64
/* The maximum number of encrypt/decrypt pipelines we can support */
# define SSL_MAX_PIPELINES 32
diff --git a/ssl/ssl_asn1.c b/ssl/ssl_asn1.c
index 1da1c82..9af4b84 100644
--- a/ssl/ssl_asn1.c
+++ b/ssl/ssl_asn1.c
@@ -41,7 +41,6 @@ typedef struct {
uint64_t flags;
uint32_t max_early_data;
ASN1_OCTET_STRING *alpn_selected;
- ASN1_OCTET_STRING *tick_nonce;
uint32_t tlsext_max_fragment_len_mode;
ASN1_OCTET_STRING *ticket_appdata;
} SSL_SESSION_ASN1;
@@ -73,9 +72,8 @@ ASN1_SEQUENCE(SSL_SESSION_ASN1) = {
ASN1_EXP_OPT_EMBED(SSL_SESSION_ASN1, tlsext_tick_age_add, ZUINT32, 14),
ASN1_EXP_OPT_EMBED(SSL_SESSION_ASN1, max_early_data, ZUINT32, 15),
ASN1_EXP_OPT(SSL_SESSION_ASN1, alpn_selected, ASN1_OCTET_STRING, 16),
- ASN1_EXP_OPT(SSL_SESSION_ASN1, tick_nonce, ASN1_OCTET_STRING, 17),
- ASN1_EXP_OPT_EMBED(SSL_SESSION_ASN1, tlsext_max_fragment_len_mode, ZUINT32, 18),
- ASN1_EXP_OPT(SSL_SESSION_ASN1, ticket_appdata, ASN1_OCTET_STRING, 19)
+ ASN1_EXP_OPT_EMBED(SSL_SESSION_ASN1, tlsext_max_fragment_len_mode, ZUINT32, 17),
+ ASN1_EXP_OPT(SSL_SESSION_ASN1, ticket_appdata, ASN1_OCTET_STRING, 18)
} static_ASN1_SEQUENCE_END(SSL_SESSION_ASN1)
IMPLEMENT_STATIC_ASN1_ENCODE_FUNCTIONS(SSL_SESSION_ASN1)
@@ -124,7 +122,6 @@ int i2d_SSL_SESSION(SSL_SESSION *in, unsigned char **pp)
ASN1_OCTET_STRING psk_identity, psk_identity_hint;
#endif
ASN1_OCTET_STRING alpn_selected;
- ASN1_OCTET_STRING tick_nonce;
ASN1_OCTET_STRING ticket_appdata;
long l;
@@ -195,12 +192,6 @@ int i2d_SSL_SESSION(SSL_SESSION *in, unsigned char **pp)
ssl_session_oinit(&as.alpn_selected, &alpn_selected,
in->ext.alpn_selected, in->ext.alpn_selected_len);
- if (in->ext.tick_nonce == NULL)
- as.tick_nonce = NULL;
- else
- ssl_session_oinit(&as.tick_nonce, &tick_nonce,
- in->ext.tick_nonce, in->ext.tick_nonce_len);
-
as.tlsext_max_fragment_len_mode = in->ext.max_fragment_len_mode;
if (in->ticket_appdata == NULL)
@@ -299,7 +290,7 @@ SSL_SESSION *d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp,
goto err;
if (!ssl_session_memcpy(ret->master_key, &tmpl,
- as->master_key, TLS13_MAX_RESUMPTION_MASTER_LENGTH))
+ as->master_key, TLS13_MAX_RESUMPTION_PSK_LENGTH))
goto err;
ret->master_key_length = tmpl;
@@ -374,15 +365,6 @@ SSL_SESSION *d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp,
ret->ext.alpn_selected_len = 0;
}
- if (as->tick_nonce != NULL) {
- ret->ext.tick_nonce = as->tick_nonce->data;
- ret->ext.tick_nonce_len = as->tick_nonce->length;
- as->tick_nonce->data = NULL;
- } else {
- ret->ext.tick_nonce = NULL;
- ret->ext.tick_nonce_len = 0;
- }
-
ret->ext.max_fragment_len_mode = as->tlsext_max_fragment_len_mode;
if (as->ticket_appdata != NULL) {
diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h
index 31e5cc8..86c250b 100644
--- a/ssl/ssl_locl.h
+++ b/ssl/ssl_locl.h
@@ -470,6 +470,8 @@ struct ssl_method_st {
long (*ssl_ctx_callback_ctrl) (SSL_CTX *s, int cb_id, void (*fp) (void));
};
+# define TLS13_MAX_RESUMPTION_PSK_LENGTH 64
+
/*-
* Lets make this into an ASN.1 type structure as follows
* SSL_SESSION_ID ::= SEQUENCE {
@@ -505,9 +507,9 @@ struct ssl_session_st {
unsigned char early_secret[EVP_MAX_MD_SIZE];
/*
* For <=TLS1.2 this is the master_key. For TLS1.3 this is the resumption
- * master secret
+ * PSK
*/
- unsigned char master_key[TLS13_MAX_RESUMPTION_MASTER_LENGTH];
+ unsigned char master_key[TLS13_MAX_RESUMPTION_PSK_LENGTH];
/* session_id - valid? */
size_t session_id_length;
unsigned char session_id[SSL_MAX_SSL_SESSION_ID_LENGTH];
@@ -567,8 +569,6 @@ struct ssl_session_st {
/* Session lifetime hint in seconds */
unsigned long tick_lifetime_hint;
uint32_t tick_age_add;
- unsigned char *tick_nonce;
- size_t tick_nonce_len;
int tick_identity;
/* Max number of bytes that can be sent as early data */
uint32_t max_early_data;
@@ -1125,12 +1125,12 @@ struct ssl_st {
*/
uint32_t mac_flags;
/*
- * The TLS1.3 secrets. The resumption master secret is stored in the
- * session.
+ * The TLS1.3 secrets.
*/
unsigned char early_secret[EVP_MAX_MD_SIZE];
unsigned char handshake_secret[EVP_MAX_MD_SIZE];
unsigned char master_secret[EVP_MAX_MD_SIZE];
+ unsigned char resumption_master_secret[EVP_MAX_MD_SIZE];
unsigned char client_finished_secret[EVP_MAX_MD_SIZE];
unsigned char server_finished_secret[EVP_MAX_MD_SIZE];
unsigned char server_finished_hash[EVP_MAX_MD_SIZE];
@@ -1422,6 +1422,8 @@ struct ssl_st {
size_t num_tickets;
/* The number of TLS1.3 tickets actually sent so far */
size_t sent_tickets;
+ /* The next nonce value to use when we send a ticket on this connection */
+ uint64_t next_ticket_nonce;
};
/*
diff --git a/ssl/ssl_sess.c b/ssl/ssl_sess.c
index 52ec670..525edb3 100644
--- a/ssl/ssl_sess.c
+++ b/ssl/ssl_sess.c
@@ -133,7 +133,6 @@ SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int ticket)
#endif
dest->peer_chain = NULL;
dest->peer = NULL;
- dest->ext.tick_nonce = NULL;
dest->ticket_appdata = NULL;
memset(&dest->ex_data, 0, sizeof(dest->ex_data));
@@ -230,13 +229,6 @@ SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int ticket)
}
}
- if (src->ext.tick_nonce != NULL) {
- dest->ext.tick_nonce = OPENSSL_memdup(src->ext.tick_nonce,
- src->ext.tick_nonce_len);
- if (dest->ext.tick_nonce == NULL)
- goto err;
- }
-
#ifndef OPENSSL_NO_SRP
if (src->srp_username) {
dest->srp_username = OPENSSL_strdup(src->srp_username);
@@ -824,7 +816,6 @@ void SSL_SESSION_free(SSL_SESSION *ss)
OPENSSL_free(ss->srp_username);
#endif
OPENSSL_free(ss->ext.alpn_selected);
- OPENSSL_free(ss->ext.tick_nonce);
OPENSSL_free(ss->ticket_appdata);
CRYPTO_THREAD_lock_free(ss->lock);
OPENSSL_clear_free(ss, sizeof(*ss));
diff --git a/ssl/statem/extensions.c b/ssl/statem/extensions.c
index 209b4df..8885e5e 100644
--- a/ssl/statem/extensions.c
+++ b/ssl/statem/extensions.c
@@ -1421,13 +1421,11 @@ int tls_psk_do_binder(SSL *s, const EVP_MD *md, const unsigned char *msgstart,
EVP_MD_CTX *mctx = NULL;
unsigned char hash[EVP_MAX_MD_SIZE], binderkey[EVP_MAX_MD_SIZE];
unsigned char finishedkey[EVP_MAX_MD_SIZE], tmpbinder[EVP_MAX_MD_SIZE];
- unsigned char tmppsk[EVP_MAX_MD_SIZE];
- unsigned char *early_secret, *psk;
- const char resumption_label[] = "res binder";
- const char external_label[] = "ext binder";
- const char nonce_label[] = "resumption";
- const char *label;
- size_t bindersize, labelsize, psklen, hashsize;
+ unsigned char *early_secret;
+ static const unsigned char resumption_label[] = "res binder";
+ static const unsigned char external_label[] = "ext binder";
+ const unsigned char *label;
+ size_t bindersize, labelsize, hashsize;
int hashsizei = EVP_MD_size(md);
int ret = -1;
int usepskfored = 0;
@@ -1454,21 +1452,6 @@ int tls_psk_do_binder(SSL *s, const EVP_MD *md, const unsigned char *msgstart,
labelsize = sizeof(resumption_label) - 1;
}
- if (external) {
- psk = sess->master_key;
- psklen = sess->master_key_length;
- } else {
- psk = tmppsk;
- psklen = hashsize;
- if (!tls13_hkdf_expand(s, md, sess->master_key,
- (const unsigned char *)nonce_label,
- sizeof(nonce_label) - 1, sess->ext.tick_nonce,
- sess->ext.tick_nonce_len, psk, hashsize)) {
- /* SSLfatal() already called */
- goto err;
- }
- }
-
/*
* Generate the early_secret. On the server side we've selected a PSK to
* resume with (internal or external) so we always do this. On the client
@@ -1481,7 +1464,9 @@ int tls_psk_do_binder(SSL *s, const EVP_MD *md, const unsigned char *msgstart,
early_secret = (unsigned char *)s->early_secret;
else
early_secret = (unsigned char *)sess->early_secret;
- if (!tls13_generate_secret(s, md, NULL, psk, psklen, early_secret)) {
+
+ if (!tls13_generate_secret(s, md, NULL, sess->master_key,
+ sess->master_key_length, early_secret)) {
/* SSLfatal() already called */
goto err;
}
@@ -1500,8 +1485,8 @@ int tls_psk_do_binder(SSL *s, const EVP_MD *md, const unsigned char *msgstart,
}
/* Generate the binder key */
- if (!tls13_hkdf_expand(s, md, early_secret, (unsigned char *)label,
- labelsize, hash, hashsize, binderkey, hashsize)) {
+ if (!tls13_hkdf_expand(s, md, early_secret, label, labelsize, hash,
+ hashsize, binderkey, hashsize)) {
/* SSLfatal() already called */
goto err;
}
diff --git a/ssl/statem/statem_clnt.c b/ssl/statem/statem_clnt.c
index 6c0f8be..ff35384 100644
--- a/ssl/statem/statem_clnt.c
+++ b/ssl/statem/statem_clnt.c
@@ -22,6 +22,7 @@
#include <openssl/dh.h>
#include <openssl/bn.h>
#include <openssl/engine.h>
+#include <internal/cryptlib.h>
static MSG_PROCESS_RETURN tls_process_as_hello_retry_request(SSL *s, PACKET *pkt);
static MSG_PROCESS_RETURN tls_process_encrypted_extensions(SSL *s, PACKET *pkt);
@@ -2558,16 +2559,15 @@ MSG_PROCESS_RETURN tls_process_new_session_ticket(SSL *s, PACKET *pkt)
RAW_EXTENSION *exts = NULL;
PACKET nonce;
+ PACKET_null_init(&nonce);
+
if (!PACKET_get_net_4(pkt, &ticket_lifetime_hint)
|| (SSL_IS_TLS13(s)
&& (!PACKET_get_net_4(pkt, &age_add)
- || !PACKET_get_length_prefixed_1(pkt, &nonce)
- || !PACKET_memdup(&nonce, &s->session->ext.tick_nonce,
- &s->session->ext.tick_nonce_len)))
+ || !PACKET_get_length_prefixed_1(pkt, &nonce)))
|| !PACKET_get_net_2(pkt, &ticklen)
- || (!SSL_IS_TLS13(s) && PACKET_remaining(pkt) != ticklen)
- || (SSL_IS_TLS13(s)
- && (ticklen == 0 || PACKET_remaining(pkt) < ticklen))) {
+ || (SSL_IS_TLS13(s) ? (ticklen == 0 || PACKET_remaining(pkt) < ticklen)
+ : PACKET_remaining(pkt) != ticklen)) {
SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_NEW_SESSION_TICKET,
SSL_R_LENGTH_MISMATCH);
goto err;
@@ -2674,6 +2674,32 @@ MSG_PROCESS_RETURN tls_process_new_session_ticket(SSL *s, PACKET *pkt)
/* This is a standalone message in TLSv1.3, so there is no more to read */
if (SSL_IS_TLS13(s)) {
+ const EVP_MD *md = ssl_handshake_md(s);
+ int hashleni = EVP_MD_size(md);
+ size_t hashlen;
+ static const unsigned char nonce_label[] = "resumption";
+
+ /* Ensure cast to size_t is safe */
+ if (!ossl_assert(hashleni >= 0)) {
+ SSLfatal(s, SSL_AD_INTERNAL_ERROR,
+ SSL_F_TLS_PROCESS_NEW_SESSION_TICKET,
+ ERR_R_INTERNAL_ERROR);
+ goto err;
+ }
+ hashlen = (size_t)hashleni;
+
+ if (!tls13_hkdf_expand(s, md, s->resumption_master_secret,
+ nonce_label,
+ sizeof(nonce_label) - 1,
+ PACKET_data(&nonce),
+ PACKET_remaining(&nonce),
+ s->session->master_key,
+ hashlen)) {
+ /* SSLfatal() already called */
+ goto err;
+ }
+ s->session->master_key_length = hashlen;
+
OPENSSL_free(exts);
ssl_update_cache(s, SSL_SESS_CACHE_CLIENT);
return MSG_PROCESS_FINISHED_READING;
diff --git a/ssl/statem/statem_srvr.c b/ssl/statem/statem_srvr.c
index ce8cec1..c2976b7 100644
--- a/ssl/statem/statem_srvr.c
+++ b/ssl/statem/statem_srvr.c
@@ -24,6 +24,8 @@
#include <openssl/bn.h>
#include <openssl/md5.h>
+#define TICKET_NONCE_SIZE 8
+
static int tls_construct_encrypted_extensions(SSL *s, WPACKET *pkt);
/*
@@ -3751,6 +3753,7 @@ int tls_construct_new_session_ticket(SSL *s, WPACKET *pkt)
unsigned char iv[EVP_MAX_IV_LENGTH];
unsigned char key_name[TLSEXT_KEYNAME_LENGTH];
int iv_len;
+ unsigned char tick_nonce[TICKET_NONCE_SIZE];
size_t macoffset, macendoffset;
union {
unsigned char age_add_c[sizeof(uint32_t)];
@@ -3758,14 +3761,27 @@ int tls_construct_new_session_ticket(SSL *s, WPACKET *pkt)
} age_add_u;
if (SSL_IS_TLS13(s)) {
+ size_t i, hashlen;
+ uint64_t nonce;
+ static const unsigned char nonce_label[] = "resumption";
+ const EVP_MD *md = ssl_handshake_md(s);
void (*cb) (const SSL *ssl, int type, int val) = NULL;
+ int hashleni = EVP_MD_size(md);
+
+ /* Ensure cast to size_t is safe */
+ if (!ossl_assert(hashleni >= 0)) {
+ SSLfatal(s, SSL_AD_INTERNAL_ERROR,
+ SSL_F_TLS_CONSTRUCT_NEW_SESSION_TICKET,
+ ERR_R_INTERNAL_ERROR);
+ goto err;
+ }
+ hashlen = (size_t)hashleni;
if (s->info_callback != NULL)
cb = s->info_callback;
else if (s->ctx->info_callback != NULL)
cb = s->ctx->info_callback;
-
if (cb != NULL) {
/*
* We don't start and stop the handshake in between each ticket when
@@ -3806,20 +3822,25 @@ int tls_construct_new_session_ticket(SSL *s, WPACKET *pkt)
goto err;
}
s->session->ext.tick_age_add = age_add_u.age_add;
- /*
- * ticket_nonce is set to a single 0 byte because we only ever send a
- * single ticket per connection. IMPORTANT: If we ever support multiple
- * tickets per connection then this will need to be changed.
- */
- OPENSSL_free(s->session->ext.tick_nonce);
- s->session->ext.tick_nonce = OPENSSL_zalloc(sizeof(char));
- if (s->session->ext.tick_nonce == NULL) {
- SSLfatal(s, SSL_AD_INTERNAL_ERROR,
- SSL_F_TLS_CONSTRUCT_NEW_SESSION_TICKET,
- ERR_R_MALLOC_FAILURE);
+
+ nonce = s->next_ticket_nonce;
+ for (i = TICKET_NONCE_SIZE; i > 0; i--) {
+ tick_nonce[i - 1] = (unsigned char)(nonce & 0xff);
+ nonce >>= 8;
+ }
+
+ if (!tls13_hkdf_expand(s, md, s->resumption_master_secret,
+ nonce_label,
+ sizeof(nonce_label) - 1,
+ tick_nonce,
+ TICKET_NONCE_SIZE,
+ s->session->master_key,
+ hashlen)) {
+ /* SSLfatal() already called */
goto err;
}
- s->session->ext.tick_nonce_len = 1;
+ s->session->master_key_length = hashlen;
+
s->session->time = (long)time(NULL);
if (s->s3->alpn_selected != NULL) {
OPENSSL_free(s->session->ext.alpn_selected);
@@ -3962,8 +3983,8 @@ int tls_construct_new_session_ticket(SSL *s, WPACKET *pkt)
? 0 : s->session->timeout)
|| (SSL_IS_TLS13(s)
&& (!WPACKET_put_bytes_u32(pkt, age_add_u.age_add)
- || !WPACKET_sub_memcpy_u8(pkt, s->session->ext.tick_nonce,
- s->session->ext.tick_nonce_len)))
+ || !WPACKET_sub_memcpy_u8(pkt, tick_nonce,
+ TICKET_NONCE_SIZE)))
/* Now the actual ticket data */
|| !WPACKET_start_sub_packet_u16(pkt)
|| !WPACKET_get_total_written(pkt, &macoffset)
@@ -4002,7 +4023,13 @@ int tls_construct_new_session_ticket(SSL *s, WPACKET *pkt)
/* SSLfatal() already called */
goto err;
}
+ /*
+ * Increment both |sent_tickets| and |next_ticket_nonce|. |sent_tickets|
+ * gets reset to 0 if we send more tickets following a post-handshake
+ * auth, but |next_ticket_nonce| does not.
+ */
s->sent_tickets++;
+ s->next_ticket_nonce++;
ssl_update_cache(s, SSL_SESS_CACHE_SERVER);
}
EVP_CIPHER_CTX_free(ctx);
diff --git a/ssl/tls13_enc.c b/ssl/tls13_enc.c
index 3fc8e96..264381b 100644
--- a/ssl/tls13_enc.c
+++ b/ssl/tls13_enc.c
@@ -602,12 +602,11 @@ int tls13_change_cipher_state(SSL *s, int which)
if (!tls13_hkdf_expand(s, ssl_handshake_md(s), insecret,
resumption_master_secret,
sizeof(resumption_master_secret) - 1,
- hashval, hashlen, s->session->master_key,
+ hashval, hashlen, s->resumption_master_secret,
hashlen)) {
/* SSLfatal() already called */
goto err;
}
- s->session->master_key_length = hashlen;
}
if (!derive_secret_key_and_iv(s, which & SSL3_CC_WRITE, md, cipher,
diff --git a/test/session.pem b/test/session.pem
index 8b01ffc..ea0b0bc 100644
--- a/test/session.pem
+++ b/test/session.pem
@@ -1,7 +1,7 @@
-----BEGIN SSL SESSION PARAMETERS-----
-MIIFRAIBAQICAwQEAhMCBCDom190ggLdEV9HNhMrbc8/MLs9NS3nqoWFoIJLgQqS
-tgQwzskkzvykWInToBTKeUhVYe4BidOBYHdHZ65Z2ETBf63lz1dMKRraxwl6K07f
-BUyBoQYCBFlct3qiBAICHCCjggPrMIID5zCCAs+gAwIBAgIJALnu1NlVpZ6zMA0G
+MIIFSgIBAQICAwQEAhMCBCAUv8MKab5ruWM6I8xtEH++u+bb2B1OznYnDrRcpLll
+6AQwzwJoGXOQ3uCa7bCy07owBiH4Bf13MiDtwaHSnNTEyfLEZBy3SgCE06wa5TJk
+Fx8aoQYCBFsWdRqiBAICHCCjggPrMIID5zCCAs+gAwIBAgIJALnu1NlVpZ6zMA0G
CSqGSIb3DQEBBQUAMHAxCzAJBgNVBAYTAlVLMRYwFAYDVQQKDA1PcGVuU1NMIEdy
b3VwMSIwIAYDVQQLDBlGT1IgVEVTVElORyBQVVJQT1NFUyBPTkxZMSUwIwYDVQQD
DBxPcGVuU1NMIFRlc3QgSW50ZXJtZWRpYXRlIENBMB4XDTExMTIwODE0MDE0OFoX
@@ -22,10 +22,10 @@ Wz9qoeoFZax+QBpIZYjROU3TS3fpyLsrnlr0CDQ5R7kCCDGa8dkXxemmpZZLbUCp
W2Uoy8sAA4JjN9OtsZY7dvUXFgJ7vVNTRnI01ghknbtD+2SxSQd3CWF6QhcRMAzZ
J1z1cbbwGDDzfvGFPzJ+Sq+zEPdsxoVLLSetCiBc+40ZcDS5dV98h9XD7JMTQfxz
A7mNGv73JoZJA6nFgj+ADSlJsY/tJBv+z1iQRueoh9Qeee+ZbRifPouCB8FDx+Al
-tvHTANdAq0t/K3o+pplMVKQCBAClAwIBFakEAgIcIKqBwwSBwFNYKC1r6z0zp+wI
-V+A8n63Wh4X/0HtKa7dJCGhvLxjI+BL9QK8JB2Qrs3OR32VjVyVWD9K0atHwhyTR
-wwFJfBEfgv9reCtOiQg2oHadD3iCbHjhhGCvbj+zCChMGSEE8NtqkBpwGATtwgN7
-qoLShh+JyHwhfXWKhKlEibr8W0ipe6R3VUW9+wsW8nTGs4FmvQSIkLI1WCr226LN
-wkRIx5+3Q3mZB39Epco4srvyLy8J/B+x2lhUdIpov7VBz++C864GAgRYHFWqrwQC
-AkAAsQMEAQA=
+tvHTANdAq0t/K3o+pplMVKQCBAClAwIBFakEAgIcIKqB0wSB0EMQ5938LY/ASVsV
+0kStjTVOps9p3VT071bTjD3RR211+gLzBwGCk8gWNH1glJXjLAenh9E2ivDK1tYQ
+3ODRdB3V46t9E78r0uAmSG/WMJ9OvkFlXyIhseYwvWW0P1cAYPI/j3Evgcyu9GIs
+HSDVEKbBy9CJYCkW/SrT+2A3ouqp+wSW0XgDLFFB+mBte2Hg7wv2uILrYZ4Y0fNe
+CUcTq8B+0EFEiq7p0KRGXwpSKYxNw7qZgg/Us3W85BYMnzYjfDzN0KHf+BI28VRT
+Rjxuud2uBwIFANHVD/k=
-----END SSL SESSION PARAMETERS-----
More information about the openssl-commits
mailing list