]> git.ipfire.org Git - thirdparty/openvpn.git/commit
Set SSL_OP_NO_TICKET flag in SSL context for OpenSSL builds, to disable TLS stateless...
authorJames Yonan <james@openvpn.net>
Mon, 17 Mar 2014 00:49:36 +0000 (18:49 -0600)
committerGert Doering <gert@greenie.muc.de>
Mon, 17 Mar 2014 18:43:03 +0000 (19:43 +0100)
commit058e889d186c616c648802da2eadf0380086bd6e
tree3cbd780918c4e91fb7fc8bc300d0d4d034ae0752
parent74d53c9bf986d835e1862aa3989fac186b5d76f3
Set SSL_OP_NO_TICKET flag in SSL context for OpenSSL builds, to disable TLS stateless session resumption.

OpenVPN doesn't want or need SSL session renegotiation or
resumption, as it handles renegotiation on its own.

For this reason, OpenVPN always disables the SSL session cache:

SSL_CTX_set_session_cache_mode (ctx, SSL_SESS_CACHE_OFF)

However, even with the above code, stateless session resumption
is still possible unless explicitly disabled with the
SSL_OP_NO_TICKET flag.  This patch does this.

Acked-by: Steffan Karger <steffan.karger@fox-it.com>
Message-Id: <1395017376-24554-1-git-send-email-james@openvpn.net>
URL: http://article.gmane.org/gmane.network.openvpn.devel/8346

Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 25f4d4b49bff342fd9dd54cd22f14c9de49e9f8b)
src/openvpn/ssl_openssl.c