[GIT PULL V2] Fixes for rekeying, Android builds, etc.

Nikos Mavrogiannopoulos nmav at gnutls.org
Mon Feb 17 08:32:59 EST 2014


On Sun, Feb 16, 2014 at 11:12 PM, Kevin Cernekee <cernekee at gmail.com> wrote:

> You guys might want to hold off on "Rework DTLS master secret
> (re)generation" depending on what Nikos' rekeying changes wind up looking
> like?

I have completed the changes in the rekey branch. In that branch
openconnect behaves:
1a. On anyconnect servers that send "X-CSTP-Rekey-Method: new-tunnel"
 The same as anyconnect clients. On rekey time when CSTP reconnects,
the DTLS reconnects as well.

1b. On anyconnect servers that send "X-CSTP-Rekey-Method: ssl"
 The same as anyconnect clients. On rekey time when CSTP rehandshakes,
DTLS reconnects.

2. On ocserv (that sends "X-CSTP-Rekey-Method: ssl" and
"X-DTLS-Rekey-Method: ssl")
  On CSTP rekey time CSTP rehandshakes, and on DTLS rekey time DTLS
rehandshakes.

I have tested all the above cases (but with ocserv).

regards,
Nikos



More information about the openconnect-devel mailing list