git.99rst.org Git - openwrt-packages.git/blob

   1 commit 9f01534cd68de78c74b50d7b8def07a72c2a3b49
   2 Author: Olivier Houchard <ohouchard@haproxy.com>
   3 Date:   Wed Jan 2 18:46:41 2019 +0100
   4
   5     BUG/MEDIUM: ssl: Disable anti-replay protection and set max data with 0RTT.
   6
   7     When using early data, disable the OpenSSL anti-replay protection, and set
   8     the max amount of early data we're ready to accept, based on the size of
   9     buffers, or early data won't work with the released OpenSSL 1.1.1.
  10
  11     This should be backported to 1.8.
  12
  13     (cherry picked from commit 51088ce68fee0bae52118d6823873417046f9efe)
  14     Signed-off-by: Willy Tarreau <w@1wt.eu>
  15     (cherry picked from commit 6703b633078b6bae12395ee3e310427b37965d68)
  16     Signed-off-by: William Lallemand <wlallemand@haproxy.org>
  17
  18 diff --git a/src/ssl_sock.c b/src/ssl_sock.c
  19 index 24ccc4b1..11655533 100644
  20 --- a/src/ssl_sock.c
  21 +++ b/src/ssl_sock.c
  22 @@ -3821,6 +3821,10 @@ ssl_sock_initial_ctx(struct bind_conf *bind_conf)
  23         SSL_CTX_set_select_certificate_cb(ctx, ssl_sock_switchctx_cbk);
  24         SSL_CTX_set_tlsext_servername_callback(ctx, ssl_sock_switchctx_err_cbk);
  25  #elif (OPENSSL_VERSION_NUMBER >= 0x10101000L)
  26 +       if (bind_conf->ssl_conf.early_data) {
  27 +               SSL_CTX_set_options(ctx, SSL_OP_NO_ANTI_REPLAY);
  28 +               SSL_CTX_set_max_early_data(ctx, global.tune.bufsize - global.tune.maxrewrite);
  29 +       }
  30         SSL_CTX_set_client_hello_cb(ctx, ssl_sock_switchctx_cbk, NULL);
  31         SSL_CTX_set_tlsext_servername_callback(ctx, ssl_sock_switchctx_err_cbk);
  32  #else