diff options
| author | Matt Caswell <matt@openssl.org> | 2018-07-05 14:40:39 +0100 |
|---|---|---|
| committer | Matt Caswell <matt@openssl.org> | 2018-07-06 09:26:39 +0100 |
| commit | 4e8548e80e12ee73db77417ea159c58751bf4b06 (patch) | |
| tree | f12810ac428b10649ffa576bbae991b84f86c7fd /include | |
| parent | 2ddee136ec4157598b0679f9d5a5097ed77c4c01 (diff) | |
Introduce the recv_max_early_data setting
Previoulsy we just had max_early_data which controlled both the value of
max early_data that we advertise in tickets *and* the amount of early_data
that we are willing to receive from clients. This doesn't work too well in
the case where we want to reduce a previously advertised max_early_data
value. In that case clients with old, stale tickets may attempt to send us
more early data than we are willing to receive. Instead of rejecting the
early data we abort the connection if that happens.
To avoid this we introduce a new "recv_max_early_data" value. The old
max_early_data becomes the value that is advertised in tickets while
recv_max_early_data is the maximum we will tolerate from clients.
Fixes #6647
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/6655)
Diffstat (limited to 'include')
| -rw-r--r-- | include/openssl/ssl.h | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/include/openssl/ssl.h b/include/openssl/ssl.h index bbcfb3c0b3..2376828e70 100644 --- a/include/openssl/ssl.h +++ b/include/openssl/ssl.h @@ -919,6 +919,10 @@ int SSL_CTX_set_max_early_data(SSL_CTX *ctx, uint32_t max_early_data); uint32_t SSL_CTX_get_max_early_data(const SSL_CTX *ctx); int SSL_set_max_early_data(SSL *s, uint32_t max_early_data); uint32_t SSL_get_max_early_data(const SSL *s); +int SSL_CTX_set_recv_max_early_data(SSL_CTX *ctx, uint32_t recv_max_early_data); +uint32_t SSL_CTX_get_recv_max_early_data(const SSL_CTX *ctx); +int SSL_set_recv_max_early_data(SSL *s, uint32_t recv_max_early_data); +uint32_t SSL_get_recv_max_early_data(const SSL *s); #ifdef __cplusplus } |