From: Dr. Stephen Henson <steve@openssl.org>
Date: Wed, 18 Nov 2009 15:09:44 +0000 (+0000)
Subject: Servers can't end up talking SSLv2 with legacy renegotiation disabled
X-Git-Tag: OpenSSL-fips-2_0-rc1~1429
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=6cef3a7f9c5c26d7f75b53e77e25a0a64779a4af;p=oweals%2Fopenssl.git

Servers can't end up talking SSLv2 with legacy renegotiation disabled
---

diff --git a/ssl/s23_srvr.c b/ssl/s23_srvr.c
index 9d5481cd0e..773c0e38d8 100644
--- a/ssl/s23_srvr.c
+++ b/ssl/s23_srvr.c
@@ -488,6 +488,11 @@ int ssl23_get_client_hello(SSL *s)
 		SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,SSL_R_UNSUPPORTED_PROTOCOL);
 		goto err;
 #else
+		if (!(s->ctx->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
+			{
+			SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
+			goto err;
+			}
 		/* we are talking sslv2 */
 		/* we need to clean up the SSLv3/TLSv1 setup and put in the
 		 * sslv2 stuff. */