GitLab/ocserv
1
0
Fork 0
mirror of https://gitlab.com/openconnect/ocserv.git synced 2026-02-10 00:37:00 +08:00
Code Issues Packages Projects Releases Wiki Activity

Do not rehandshake on the DTLS channel.

Browse Source
This commit is contained in:
Nikos Mavrogiannopoulos
2014-01-21 18:00:21 +01:00
parent fa1bbd20f2
commit f9a1dd94ae
2 changed files with 5 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
src/worker-vpn.c
View File

@@ -1591,20 +1591,12 @@ static int connect_handler(worker_st * ws)
"no data received (%d)", ret);
if (ret == GNUTLS_E_REHANDSHAKE) {
/* rekey? */
if (ws->last_dtls_rehandshake > 0 &&
now-ws->last_dtls_rehandshake < ws->config->cookie_validity/3) {
oclog(ws, LOG_ERR, "client requested DTLS rehandshake too soon");
goto exit;
}
oclog(ws, LOG_INFO, "client requested rehandshake on DTLS channel");
do {
ret = gnutls_handshake(ws->dtls_session);
} while (ret < 0 && gnutls_error_is_fatal(ret) == 0);
/* there is not much we can rehandshake on the DTLS channel,
* at least not the way AnyConnect sets it up.
*/
oclog(ws, LOG_INFO, "client requested rehandshake on DTLS channel (!)");
ret = gnutls_alert_send(ws->dtls_session, GNUTLS_AL_WARNING, GNUTLS_A_NO_RENEGOTIATION);
GNUTLS_FATAL_ERR(ret);
ws->last_dtls_rehandshake = now;
}
udp_recv_time = now;

1
src/worker.h
View File

@@ -137,7 +137,6 @@ typedef struct worker_st {
/* protection from multiple rehandshakes */
time_t last_tls_rehandshake;
time_t last_dtls_rehandshake;
/* for mtu trials */
unsigned last_good_mtu;