*/
# define EARLY_DATA_CIPHERTEXT_OVERHEAD ((6 * (EVP_GCM_TLS_TAG_LEN + 1)) + 2)
+/*
+ * The allowance we have between the client's calculated ticket age and our own.
+ * We allow for 10 seconds (units are in ms). If a ticket is presented and the
+ * client's age calculation is different by more than this than our own then we
+ * do not allow that ticket for early_data.
+ */
+# define TICKET_AGE_ALLOWANCE (10 * 1000)
+
#define MAX_COMPRESSIONS_SIZE 255
struct ssl_comp_st {
/* Are we expecting to receive early data? */
int early_data;
+ /* Is the session suitable for early data? */
+ int early_data_ok;
} ext;
/* Parsed form of the ClientHello, kept around across early_cb calls. */
TLSEXT_IDX_server_name,
TLSEXT_IDX_srp,
TLSEXT_IDX_early_data_info,
- TLSEXT_IDX_early_data,
TLSEXT_IDX_ec_point_formats,
TLSEXT_IDX_supported_groups,
TLSEXT_IDX_session_ticket,
TLSEXT_IDX_psk_kex_modes,
TLSEXT_IDX_key_share,
TLSEXT_IDX_cryptopro_bug,
+ TLSEXT_IDX_early_data,
TLSEXT_IDX_padding,
TLSEXT_IDX_psk
} TLSEXT_INDEX;