GitLab/ocserv
1
0
Fork 0
mirror of https://gitlab.com/openconnect/ocserv.git synced 2026-10-13 18:12:03 +08:00
Code Issues Packages Projects Releases Wiki Activity

Do not rehandshake on the DTLS channel.

Browse Source
This commit is contained in:
Nikos Mavrogiannopoulos
2014-01-21 18:00:21 +01:00
parent fa1bbd20f2
commit f9a1dd94ae
2 changed files with 5 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/worker-vpn.c
+5 -13
View File
@@ -1591,20 +1591,12 @@ static int connect_handler(worker_st * ws)
"no data received (%d)", ret); "no data received (%d)", ret);
if (ret == GNUTLS_E_REHANDSHAKE) { if (ret == GNUTLS_E_REHANDSHAKE) {
/* rekey? */ /* there is not much we can rehandshake on the DTLS channel,
if (ws->last_dtls_rehandshake > 0 && * at least not the way AnyConnect sets it up.
now-ws->last_dtls_rehandshake < ws->config->cookie_validity/3) { */
oclog(ws, LOG_ERR, "client requested DTLS rehandshake too soon"); oclog(ws, LOG_INFO, "client requested rehandshake on DTLS channel (!)");
goto exit; ret = gnutls_alert_send(ws->dtls_session, GNUTLS_AL_WARNING, GNUTLS_A_NO_RENEGOTIATION);
}
oclog(ws, LOG_INFO, "client requested rehandshake on DTLS channel");
do {
ret = gnutls_handshake(ws->dtls_session);
} while (ret < 0 && gnutls_error_is_fatal(ret) == 0);
GNUTLS_FATAL_ERR(ret); GNUTLS_FATAL_ERR(ret);
ws->last_dtls_rehandshake = now;
} }
udp_recv_time = now; udp_recv_time = now;
src/worker.h
-1
View File
@@ -137,7 +137,6 @@ typedef struct worker_st {
/* protection from multiple rehandshakes */ /* protection from multiple rehandshakes */
time_t last_tls_rehandshake; time_t last_tls_rehandshake;
time_t last_dtls_rehandshake;
/* for mtu trials */ /* for mtu trials */
unsigned last_good_mtu; unsigned last_good_mtu;