crypto/tls: CL 737700 broke session resumption on macOS

[FiloSottile]

Before CL 737700, this code printed Resumed: true, now it prints Resumed: false.

package main

import (
	"crypto/tls"
	"fmt"
	"log"
)

func main() {
	config := &tls.Config{
		ClientSessionCache: tls.NewLRUClientSessionCache(0),
	}

	conn, err := tls.Dial("tcp", "google.com:443", config)
	if err != nil {
		log.Fatal(err)
	}
	fmt.Fprintf(conn, "GET / HTTP/1.1\r\nHost: google.com\r\nConnection: close\r\n\r\n")
	conn.Read(make([]byte, 4096))
	conn.Close()

	conn, err = tls.Dial("tcp", "google.com:443", config)
	if err != nil {
		log.Fatal(err)
	}
	state := conn.ConnectionState()
	conn.Close()

	fmt.Println("Resumed:", state.DidResume)
}

We should fix it before the release.

/cc @golang/release @rolandshoemaker

[gabyhelp]

Related Issues

• crypto/tls: usage of QUICResumeSession in Go 1.23rc1 breaks backwards compatibility #68124 (closed)
• crypto/tls: session resumption (session id caching) #18607 (closed)
• crypto/tls: session resumption fails with a cloned tls.Config #60506

Related Code Changes

• crypto/tls: check verifiedChains roots when resuming sessions

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[gopherbot]

Change https://go.dev/cl/741361 mentions this issue: crypto/tls: revalidate whole chain on resumption on Windows and macOS

[rolandshoemaker]

@gopherbot please open backport issues for 1.24, 1.25, and 1.26

[gopherbot]

Backport issue(s) opened: #77424 (for 1.24), #77425 (for 1.25), #77426 (for 1.26).

Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.