Lock sessionController only on last call to BuildHandshakeState

u_conn.go

@@ -125,24 +125,30 @@ func (uconn *UConn) BuildHandshakeState() error {
 			return err
 		}
 
-		err = uconn.uLoadSession()
-		if err != nil {
-			return err
-		}
-
 		err = uconn.MarshalClientHello()
 		if err != nil {
 			return err
 		}
 
-		uconn.uApplyPatch()
-
-		uconn.sessionController.finalCheck()
-		uconn.clientHelloBuildStatus = BuildByUtls
 	}
 	return nil
 }
 
+func (uconn *UConn) lockSessionState() error {
+
+	err := uconn.uLoadSession()
+	if err != nil {
+		return err
+	}
+
+	uconn.uApplyPatch()
+
+	uconn.sessionController.finalCheck()
+	uconn.clientHelloBuildStatus = BuildByUtls
+
+	return nil
+}
+
 func (uconn *UConn) uLoadSession() error {
 	if cfg := uconn.config; cfg.SessionTicketsDisabled || cfg.ClientSessionCache == nil {
 		return nil
@@ -358,6 +364,10 @@ func (c *UConn) handshakeContext(ctx context.Context) (ret error) {
 		if err != nil {
 			return err
 		}
+		err = c.lockSessionState()
+		if err != nil {
+			return err
+		}
 	}
 	// [uTLS section ends]
 	c.handshakeErr = c.handshakeFn(handshakeCtx)
@@ -983,6 +993,9 @@ func (c *UConn) handleRenegotiation() error {
 	if err = c.BuildHandshakeState(); err != nil {
 		return err
 	}
+	if err = c.lockSessionState(); err != nil {
+		return err
+	}
 	// [uTLS section ends]
 	if c.handshakeErr = c.clientHandshake(context.Background()); c.handshakeErr == nil {
 		c.handshakes++

u_conn_test.go

@@ -512,6 +512,11 @@ func (test *clientTest) runUTLS(t *testing.T, write bool, hello helloStrategy, o
 			t.Errorf("Client.BuildHandshakeState() failed: %s", err)
 			return
 		}
+		err = client.lockSessionState()
+		if err != nil {
+			t.Errorf("Client.lockSessionState() failed: %s", err)
+			return
+		}
 		// TODO: fix this name hack if we ever decide to use non-standard testing object
 		err = client.SetClientRandom([]byte("Custom ClientRandom h^xbw8bf0sn3"))
 		if err != nil {