From: Jouni Malinen Date: Fri, 17 Aug 2012 19:21:28 +0000 (+0300) Subject: Add phase1/phase2 parameter for disabling TLS Session Ticket extension X-Git-Tag: hostap_2_0~391 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f210493b6e82cd1aca6e4be3aec8e0e0b80a7cf8;p=thirdparty%2Fhostap.git Add phase1/phase2 parameter for disabling TLS Session Ticket extension tls_disable_session_ticket=1 in phase1/phase2 can now be used to disable use of TLS Session Ticket extension (which is enabled by default in recent OpenSSL versions). This can be used to work around issues with broken authentication servers that do not ignore unrecognized TLS extensions properly. Signed-hostap: Jouni Malinen --- diff --git a/src/eap_peer/eap_tls_common.c b/src/eap_peer/eap_tls_common.c index c91d863ae..3291048b0 100644 --- a/src/eap_peer/eap_tls_common.c +++ b/src/eap_peer/eap_tls_common.c @@ -48,6 +48,10 @@ static void eap_tls_params_flags(struct tls_connection_params *params, params->flags |= TLS_CONN_ALLOW_SIGN_RSA_MD5; if (os_strstr(txt, "tls_disable_time_checks=1")) params->flags |= TLS_CONN_DISABLE_TIME_CHECKS; + if (os_strstr(txt, "tls_disable_session_ticket=1")) + params->flags |= TLS_CONN_DISABLE_SESSION_TICKET; + if (os_strstr(txt, "tls_disable_session_ticket=0")) + params->flags &= ~TLS_CONN_DISABLE_SESSION_TICKET; }