From: Dr. Stephen Henson <steve@openssl.org>
Date: Tue, 16 Feb 2010 14:21:11 +0000 (+0000)
Subject: PR: 2171
X-Git-Tag: OpenSSL-fips-2_0-rc1~1268
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=8d934c2585b2938344af328799286fd2526b579d;p=oweals%2Fopenssl.git

PR: 2171
Submitted by: Tomas Mraz <tmraz@redhat.com>

Since SSLv2 doesn't support renegotiation at all don't reject it if
legacy renegotiation isn't enabled.

Also can now use SSL2 compatible client hello because RFC5746 supports it.
---

diff --git a/ssl/s23_clnt.c b/ssl/s23_clnt.c
index b2a3eb02fb..e6f9bf952a 100644
--- a/ssl/s23_clnt.c
+++ b/ssl/s23_clnt.c
@@ -311,9 +311,6 @@ static int ssl23_client_hello(SSL *s)
 			ssl2_compat = 0;
 		if (s->tlsext_status_type != -1)
 			ssl2_compat = 0;
-		if (!(s->ctx->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
-			ssl2_compat = 0;
-		
 #ifdef TLSEXT_TYPE_opaque_prf_input
 		if (s->ctx->tlsext_opaque_prf_input_callback != 0 || s->tlsext_opaque_prf_input != NULL)
 			ssl2_compat = 0;
diff --git a/ssl/s23_srvr.c b/ssl/s23_srvr.c
index 05e4e0b47b..390b99bf56 100644
--- a/ssl/s23_srvr.c
+++ b/ssl/s23_srvr.c
@@ -509,11 +509,6 @@ int ssl23_get_client_hello(SSL *s)
 		SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,SSL_R_UNSUPPORTED_PROTOCOL);
 		goto err;
 #else
-		if (!(s->ctx->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
-			{
-			SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
-			goto err;
-			}
 		/* we are talking sslv2 */
 		/* we need to clean up the SSLv3/TLSv1 setup and put in the
 		 * sslv2 stuff. */