OpenSSL: Add mechanism for disabling TLS Session Ticket extension

This can be used to implement workaround for authentication servers that
do not handle TLS extensions in ClientHello properly.

Signed-hostap: Jouni Malinen <j@w1.fi>

diff --git a/src/crypto/tls.h b/src/crypto/tls.h
index 990f6e6eda1f37aa6bb6435e23467db8c5241d4f..b61e43939f879b1fdabce63752b18a70573f468a 100644 (file)
--- a/src/crypto/tls.h
+++ b/src/crypto/tls.h
@@ -81,6 +81,7 @@ struct tls_config {
 
 #define TLS_CONN_ALLOW_SIGN_RSA_MD5 BIT(0)
 #define TLS_CONN_DISABLE_TIME_CHECKS BIT(1)
+#define TLS_CONN_DISABLE_SESSION_TICKET BIT(2)
 
 /**
  * struct tls_connection_params - Parameters for TLS connection

diff --git a/src/crypto/tls_openssl.c b/src/crypto/tls_openssl.c
index 864414cfd23b0ddb35afd5ed07bb0dadae201f99..ddab3a3b65746c2df8354bfd1b8e4d0b607533fb 100644 (file)
--- a/src/crypto/tls_openssl.c
+++ b/src/crypto/tls_openssl.c
@@ -2774,6 +2774,13 @@ int tls_connection_set_params(void *tls_ctx, struct tls_connection *conn,
                return -1;
        }
 
+#ifdef SSL_OP_NO_TICKET
+       if (params->flags & TLS_CONN_DISABLE_SESSION_TICKET)
+               SSL_set_options(conn->ssl, SSL_OP_NO_TICKET);
+       else
+               SSL_clear_options(conn->ssl, SSL_OP_NO_TICKET);
+#endif /*  SSL_OP_NO_TICKET */
+
        conn->flags = params->flags;
 
        tls_get_errors(tls_ctx);
@@ -2809,6 +2816,13 @@ int tls_global_set_params(void *tls_ctx,
                return -1;
        }
 
+#ifdef SSL_OP_NO_TICKET
+       if (params->flags & TLS_CONN_DISABLE_SESSION_TICKET)
+               SSL_CTX_set_options(ssl_ctx, SSL_OP_NO_TICKET);
+       else
+               SSL_CTX_clear_options(ssl_ctx, SSL_OP_NO_TICKET);
+#endif /*  SSL_OP_NO_TICKET */
+
        return 0;
 }