mirror of
https://gitlab.com/openconnect/ocserv.git
synced 2026-08-09 09:51:49 +08:00
Nikos Mavrogiannopoulos
9e71c1b8b6
TLS 1.3 has no renegotiation and provides transparent rekeys but this was not used by the server. Instead rekey-method=ssl was silently downgraded to new-tunnel, causing a full tunnel/TUN-device rebuild (and a brief data-path interruption) on every rekey whenever a client negotiated TLS 1.3. This commit simplifies that handling by taking advantage of TLS 1.3's own rekey mechanism instead: the server now performs the "ssl" rekey on TLS 1.3 sessions via the standard TLS 1.3 KeyUpdate message. TLS <= 1.2 rekey behavior (client-driven rehandshake, gated on RFC 5746 safe renegotiation) is unchanged. Resolves: #745 Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
55 lines
1.1 KiB
Plaintext
55 lines
1.1 KiB
Plaintext
auth = "plain[@SRCDIR@/data/test1.passwd]"
|
|
|
|
# Forced off (not @ISOLATE_WORKERS@): this test asserts on worker-emitted
|
|
# log lines, which only reliably reach the captured server output when
|
|
# worker isolation is off.
|
|
isolate-workers = false
|
|
|
|
occtl-socket-file = @OCCTL_SOCKET@
|
|
use-occtl = true
|
|
|
|
use-dbus = no
|
|
|
|
max-clients = 16
|
|
max-same-clients = 2
|
|
|
|
tcp-port = @PORT@
|
|
udp-port = @PORT@
|
|
|
|
keepalive = 32400
|
|
dpd = 440
|
|
try-mtu-discovery = false
|
|
|
|
server-cert = @SRCDIR@/certs/server-cert.pem
|
|
server-key = @SRCDIR@/certs/server-key.pem
|
|
|
|
# Force TLS 1.3 on the control channel, so the "ssl" rekey-method must
|
|
# use the transparent TLS 1.3 KeyUpdate path rather than an in-place
|
|
# TLS <= 1.2 rehandshake.
|
|
tls-priorities = "NORMAL:-VERS-ALL:+VERS-TLS1.3:%SERVER_PRECEDENCE:%COMPAT"
|
|
|
|
auth-timeout = 40
|
|
cookie-timeout = 30
|
|
|
|
use-utmp = true
|
|
pid-file = /var/run/ocserv.pid
|
|
socket-file = /var/run/ocserv-socket
|
|
|
|
run-as-user = nobody
|
|
run-as-group = daemon
|
|
|
|
device = vpns
|
|
default-domain = example.com
|
|
|
|
ipv4-network = @VPNNET@
|
|
|
|
ping-leases = false
|
|
|
|
sec-mod-scale = 6
|
|
|
|
idle-timeout = 0
|
|
mobile-idle-timeout = 0
|
|
|
|
rekey-time = 20
|
|
rekey-method = ssl
|