From: Max Fillinger Date: Mon, 12 Apr 2021 17:46:17 +0000 (+0200) Subject: Fix build with mbedtls w/o SSL renegotiation support X-Git-Tag: v2.5.3~4 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ad4f8e37617f3f020154bd224f9b693714c6370a;p=thirdparty%2Fopenvpn.git Fix build with mbedtls w/o SSL renegotiation support In mbedtls, support for SSL renegotiation can be disabled at compile-time. However, OpenVPN cannot be built with such a library because it calls mbedtls_ssl_conf_renegotiation() to disable this feature at runtime. This function doesn't exist when mbedtls was built without support for SSL renegotiation. This commit fixes the build by ifdef'ing out the function call when mbedtls was built without support for SSL renegotiation. Signed-off-by: Max Fillinger Acked-by: Antonio Quartulli Message-Id: URL: https://www.mail-archive.com/search?l=mid&q=E1lW0eX-00012w-9n@sfs-ml-1.v29.lw.sourceforge.com Signed-off-by: Gert Doering (cherry picked from commit e4bd17c86e01aaf6f809d9ea355419c86c4defdc) --- diff --git a/src/openvpn/ssl_mbedtls.c b/src/openvpn/ssl_mbedtls.c index a934e98cf..6af93e523 100644 --- a/src/openvpn/ssl_mbedtls.c +++ b/src/openvpn/ssl_mbedtls.c @@ -1098,10 +1098,13 @@ key_state_ssl_init(struct key_state_ssl *ks_ssl, { mbedtls_ssl_conf_curves(ks_ssl->ssl_config, ssl_ctx->groups); } - /* Disable TLS renegotiations. OpenVPN's renegotiation creates new SSL - * session and does not depend on this feature. And TLS renegotiations have - * been problematic in the past */ + + /* Disable TLS renegotiations if the mbedtls library supports that feature. + * OpenVPN's renegotiation creates new SSL sessions and does not depend on + * this feature and TLS renegotiations have been problematic in the past. */ +#if defined(MBEDTLS_SSL_RENEGOTIATION) mbedtls_ssl_conf_renegotiation(ks_ssl->ssl_config, MBEDTLS_SSL_RENEGOTIATION_DISABLED); +#endif /* MBEDTLS_SSL_RENEGOTIATION */ /* Disable record splitting (for now). OpenVPN assumes records are sent * unfragmented, and changing that will require thorough review and