ocserv

mirror of https://gitlab.com/openconnect/ocserv.git synced 2026-08-09 09:51:49 +08:00

Files

T

Nikos Mavrogiannopoulos 9e71c1b8b6 worker: use TLS 1.3 transparent rekey on TLS 1.3 CSTP sessions

TLS 1.3 has no renegotiation and provides transparent rekeys but this
was not used by the server. Instead rekey-method=ssl was silently
downgraded to new-tunnel, causing a full tunnel/TUN-device rebuild (and
a brief data-path interruption) on every rekey whenever a client
negotiated TLS 1.3.

This commit simplifies that handling by taking advantage of TLS 1.3's own
rekey mechanism instead: the server now performs the "ssl" rekey on
TLS 1.3 sessions via the standard TLS 1.3 KeyUpdate message.

TLS <= 1.2 rekey behavior (client-driven rehandshake, gated on RFC
5746 safe renegotiation) is unchanged.

Resolves: #745

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>

2026-07-28 08:07:07 +02:00

requirements

worker: use TLS 1.3 transparent rekey on TLS 1.3 CSTP sessions

2026-07-28 08:07:07 +02:00

scripts

Added the STATS_DURATION script environment variable.

2014-05-04 11:20:32 +02:00

systemd

Cleanup of the logging subsystem; allow logging to stderr only

2023-12-15 13:04:40 +01:00

DCO.txt

Added contribution guide and require DCO