From 8b57a378081bbc33387c86e994c7d282d413395d Mon Sep 17 00:00:00 2001 From: Jouni Malinen Date: Fri, 12 Jul 2019 22:29:33 +0300 Subject: [PATCH] OpenSSL: disable TLS 1.3 middlebox compatibility This will hopefully not be needed for EAP-TLS use cases since there should not really be a middlebox that looks at the TLS layer details in case of EAP authentication. Signed-off-by: Jouni Malinen --- src/crypto/tls_openssl.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/crypto/tls_openssl.c b/src/crypto/tls_openssl.c index d45543e66..39f453d61 100644 --- a/src/crypto/tls_openssl.c +++ b/src/crypto/tls_openssl.c @@ -1574,6 +1574,11 @@ struct tls_connection * tls_connection_init(void *ssl_ctx) options |= SSL_OP_NO_COMPRESSION; #endif /* SSL_OP_NO_COMPRESSION */ SSL_set_options(conn->ssl, options); +#ifdef SSL_OP_ENABLE_MIDDLEBOX_COMPAT + /* Hopefully there is no need for middlebox compatibility mechanisms + * when going through EAP authentication. */ + SSL_clear_options(conn->ssl, SSL_OP_ENABLE_MIDDLEBOX_COMPAT); +#endif conn->ssl_in = BIO_new(BIO_s_mem()); if (!conn->ssl_in) {