On 02/14/2014 08:46 PM, Nikos Mavrogiannopoulos wrote: > ocserv could handle that mode as well as it considers the TCP channel > the primary. That way we could support a channel that doesn't > re-establish itself at rekey time. However, I find the tearing apart and > re-establishment of the DTLS channel a waste. Would it make sense to > have a mode 'oc-ssl' that will rehandshake on both channels? And I don't think that this complexity is needed. I suppose that an AnyConnect server sends "X-DTLS-Rekey: new-tunnel" or does not send this header at all? In that case this commit would do the proper thing on anyconnect and ocserv. https://www.gitorious.org/openconnect-x/openconnect-x/commit/d93a371d696885a5b2acff1b8f597c6deb949382 regards, Nikos
