From 97bd862ed5c22956cb4405eabae64cf55cabb0d3 Mon Sep 17 00:00:00 2001 From: Steffan Karger Date: Sun, 13 Jul 2014 11:26:32 +0200 Subject: Define dummy SSL_OP_NO_TICKET flag if not present in OpenSSL. This restores support for pre-0.9.8f OpenSSL versions, which do not include stateless session resumption, and the accompanying SSL_OP_NO_TICKET flag. Signed-off-by: Steffan Karger Acked-by: Gert Doering Message-Id: <53C251E2.7050605@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/8902 Signed-off-by: Gert Doering --- src/openvpn/ssl_openssl.h | 11 +++++++++++ 1 file changed, 11 insertions(+) (limited to 'src') diff --git a/src/openvpn/ssl_openssl.h b/src/openvpn/ssl_openssl.h index fc2052c..97dc742 100644 --- a/src/openvpn/ssl_openssl.h +++ b/src/openvpn/ssl_openssl.h @@ -32,6 +32,17 @@ #include +/** + * SSL_OP_NO_TICKET tells OpenSSL to disable "stateless session resumption", + * as this is something we do not want nor need, but could potentially be + * used for a future attack. For compatibility reasons we keep building if the + * OpenSSL version is too old (pre-0.9.8f) to support stateless session + * resumption (and the accompanying SSL_OP_NO_TICKET flag). + */ +#ifndef SSL_OP_NO_TICKET +# define SSL_OP_NO_TICKET 0 +#endif + /** * Structure that wraps the TLS context. Contents differ depending on the * SSL library used. -- cgit