Introduce the recv_max_early_data setting
authorMatt Caswell <matt@openssl.org>
Thu, 5 Jul 2018 13:40:39 +0000 (14:40 +0100)
committerMatt Caswell <matt@openssl.org>
Fri, 6 Jul 2018 08:26:39 +0000 (09:26 +0100)
commit4e8548e80e12ee73db77417ea159c58751bf4b06
treef12810ac428b10649ffa576bbae991b84f86c7fd
parent2ddee136ec4157598b0679f9d5a5097ed77c4c01
Introduce the recv_max_early_data setting

Previoulsy we just had max_early_data which controlled both the value of
max early_data that we advertise in tickets *and* the amount of early_data
that we are willing to receive from clients. This doesn't work too well in
the case where we want to reduce a previously advertised max_early_data
value. In that case clients with old, stale tickets may attempt to send us
more early data than we are willing to receive. Instead of rejecting the
early data we abort the connection if that happens.

To avoid this we introduce a new "recv_max_early_data" value. The old
max_early_data becomes the value that is advertised in tickets while
recv_max_early_data is the maximum we will tolerate from clients.

Fixes #6647

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/6655)
include/openssl/ssl.h
ssl/record/ssl3_record.c
ssl/ssl_lib.c
ssl/ssl_locl.h
util/libssl.num