generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Allow renegotiation if SSL_OP_LEGACY_SERVER_CONNECT is set as well as

Browse Source 
initial connection to unpatched servers. There are no additional security
concerns in doing this as clients don't see renegotiation during an
attack anyway.
This commit is contained in:
Dr. Stephen Henson
2010-02-17 18:37:47 +00:00
parent 657b02d0cf
commit 442ac8d259
3 changed files with 15 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
ssl/t1_lib.c
View File

@@ -705,8 +705,8 @@ int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in
* which doesn't support RI so for the immediate future tolerate RI
* absence on initial connect only.
*/
if (!renegotiate_seen &&
(s->new_session || !(s->options & SSL_OP_LEGACY_SERVER_CONNECT))
if (!renegotiate_seen
&& !(s->options & SSL_OP_LEGACY_SERVER_CONNECT)
&& !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
{
*al = SSL_AD_HANDSHAKE_FAILURE;