Skip to content

Commit b8d5ac8

Browse files
committed
Add info on how to use WOLFSSL_DTLS13_NO_HRR_ON_RESUME
1 parent 2b1c61a commit b8d5ac8

1 file changed

Lines changed: 10 additions & 1 deletion

File tree

src/dtls.c

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,16 @@
2727
* will consume less bandwidth (one ClientHello and one
2828
* HelloVerifyRequest/HelloRetryRequest less). On the other hand, if a valid
2929
* SessionID/ticket/psk is collected, forged clientHello messages will
30-
* consume resources on the server.
30+
* consume resources on the server. For DTLS 1.3, using this option also
31+
* allows for the server to process Early Data/0-RTT Data. Without this, the
32+
* Early Data would be dropped since the server doesn't enter stateful
33+
* processing until receiving a verified ClientHello with the cookie.
34+
*
35+
* To allow DTLS 1.3 resumption without the cookie exchange:
36+
* - Compile wolfSSL with WOLFSSL_DTLS13_NO_HRR_ON_RESUME defined
37+
* - Call wolfSSL_dtls13_no_hrr_on_resume(ssl, 1) on the WOLFSSL object to
38+
* disable the cookie exchange on resumption
39+
* - Continue like with a normal connection
3140
* WOLFSSL_DTLS_CH_FRAG
3241
* Allow a server to process a fragmented second/verified (one containing a
3342
* valid cookie response) ClientHello message. The first/unverified (one

0 commit comments

Comments
 (0)