]> www.infradead.org Git - users/dwmw2/openconnect.git/commit
Don't resume OpenSSL DTLS session for PSK-NEGOTIATE
authorDavid Woodhouse <David.Woodhouse@intel.com>
Tue, 4 Oct 2016 22:26:33 +0000 (23:26 +0100)
committerDavid Woodhouse <David.Woodhouse@intel.com>
Tue, 4 Oct 2016 22:53:34 +0000 (23:53 +0100)
commit816a2b4450737410385bd3a16c92bd25956c44e9
tree8dcc39bbd38d8f503da8d2d07b45e0498233f02a
parentbd7d9fa8a7034dd6025496ae0327d3aee2f63ac4
Don't resume OpenSSL DTLS session for PSK-NEGOTIATE

Now that we are using a custom extension instead of the session-id
hack, we no longer need to pretend to resume a session. It was causing
a session-id of 32 zeroes to be included in the ClientHello. With
OpenSSL 1.1+, that was causing fragmentation which ocserv couldn't
cope with.

Perhaps ocserv *should* have coped with that fragmentation, and perhaps
we should increase our initial idea of the MTU to avoid the fragmentation.
But certainly we shouldn't be including an all-zero session-id for
resumption either.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
openssl-dtls.c