From 442ac8d25993b2fbdd801cae79a2e78612cfaf80 Mon Sep 17 00:00:00 2001 From: "Dr. Stephen Henson" Date: Wed, 17 Feb 2010 18:37:47 +0000 Subject: [PATCH] Allow renegotiation if SSL_OP_LEGACY_SERVER_CONNECT is set as well as initial connection to unpatched servers. There are no additional security concerns in doing this as clients don't see renegotiation during an attack anyway. --- CHANGES | 2 +- doc/ssl/SSL_CTX_set_options.pod | 21 ++++++++++++--------- ssl/t1_lib.c | 4 ++-- 3 files changed, 15 insertions(+), 12 deletions(-) diff --git a/CHANGES b/CHANGES index dca7ce58d7..c389b6535d 100644 --- a/CHANGES +++ b/CHANGES @@ -36,7 +36,7 @@ [Bodo Moeller] *) Add option SSL_OP_LEGACY_SERVER_CONNECT which will allow clients to - connect (but not renegotiate) with servers which do not support RI. + connect and renegotiate with servers which do not support RI. Until RI is more widely deployed this option is enabled by default. [Steve Henson] diff --git a/doc/ssl/SSL_CTX_set_options.pod b/doc/ssl/SSL_CTX_set_options.pod index 52c7497e3a..e87517de97 100644 --- a/doc/ssl/SSL_CTX_set_options.pod +++ b/doc/ssl/SSL_CTX_set_options.pod @@ -238,7 +238,7 @@ OpenSSL 0.9.8m and later always attempts to use secure renegotiation as described in RFC5746. This counters the prefix attack described in CVE-2009-3555 and elsewhere. -The deprecated and highly broken SSLv2 protocol does not support secure +The deprecated and highly broken SSLv2 protocol does not support renegotiation at all: its use is B discouraged. This attack has far reaching consequences which application writers should be @@ -277,10 +277,14 @@ was refused. =head2 Patched OpenSSL client and unpatched server. If the option B is set then initial connections -between patched OpenSSL clients and unpatched servers succeed. This option -is currently set by default even though it has security implications: otherwise -it would be impossible to connect to unpatched servers (i.e. all of them -initially) and this is clearly not acceptable. +and renegotiation between patched OpenSSL clients and unpatched servers +succeeds. + +This option is currently set by default even though it has security +implications: otherwise it would be impossible to connect to unpatched servers +(i.e. all of them initially) and this is clearly not acceptable. Renegotiation +is permitted because this does not add any additional security issues: during +an attack clients do not see any renegotiations anyway. As more servers become patched the option B will B be set by default in a future version of OpenSSL. @@ -293,10 +297,9 @@ unpatched servers (and thus avoid any security issues) should always B B using SSL_CTX_clear_options() or SSL_clear_options(). -Renegotiation between a patched OpenSSL client and unpatched server follows -the same scheme as between an unpatched client and a patched OpenSSL server: -i.e. it is not permitted unless the option -B is set. +As in the previous case if the option +B is set then renegotiation +B succeeds. =head1 RETURN VALUES diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c index ce24f89746..8b53112770 100644 --- a/ssl/t1_lib.c +++ b/ssl/t1_lib.c @@ -705,8 +705,8 @@ int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in * which doesn't support RI so for the immediate future tolerate RI * absence on initial connect only. */ - if (!renegotiate_seen && - (s->new_session || !(s->options & SSL_OP_LEGACY_SERVER_CONNECT)) + if (!renegotiate_seen + && !(s->options & SSL_OP_LEGACY_SERVER_CONNECT) && !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION)) { *al = SSL_AD_HANDSHAKE_FAILURE; -- 2.25.1