]> git.ipfire.org Git - thirdparty/haproxy.git/commitdiff
MINOR: quic: Do not enable O-RTT with USE_QUIC_OPENSSL_COMPAT
authorFrédéric Lécaille <flecaille@haproxy.com>
Fri, 2 Jun 2023 14:51:43 +0000 (16:51 +0200)
committerFrédéric Lécaille <flecaille@haproxy.com>
Fri, 21 Jul 2023 13:53:41 +0000 (15:53 +0200)
Modify ssl_quic_initial_ctx() to disable O-RTT when the QUIC OpenSSL wrapper was
enabled.

src/quic_conn.c

index 157cdbd730b66045656ae44b529505d222ee1045..dd2c6f2353a06fee213a608ea8a6e1723eaa60fd 100644 (file)
@@ -1444,7 +1444,9 @@ int ssl_quic_initial_ctx(struct bind_conf *bind_conf)
 #  if defined(SSL_OP_NO_ANTI_REPLAY)
        if (bind_conf->ssl_conf.early_data) {
                SSL_CTX_set_options(ctx, SSL_OP_NO_ANTI_REPLAY);
+#ifndef USE_QUIC_OPENSSL_COMPAT
                SSL_CTX_set_max_early_data(ctx, 0xffffffff);
+#endif
        }
 #  endif /* !SSL_OP_NO_ANTI_REPLAY */
        SSL_CTX_set_client_hello_cb(ctx, ssl_sock_switchctx_cbk, NULL);