From 5d965f0783713cee4b62794d2fcacebf49d0654e Mon Sep 17 00:00:00 2001 From: "Dr. Stephen Henson" Date: Wed, 18 Nov 2009 14:43:27 +0000 Subject: [PATCH] Don't use SSLv2 compatible client hello if we don't tolerate legacy renegotiation --- ssl/s23_clnt.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ssl/s23_clnt.c b/ssl/s23_clnt.c index de0238935a..70425997df 100644 --- a/ssl/s23_clnt.c +++ b/ssl/s23_clnt.c @@ -235,6 +235,8 @@ static int ssl23_client_hello(SSL *s) ssl2_compat = 0; if (s->tlsext_status_type != -1) ssl2_compat = 0; + if (!(s->ctx->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION)) + ssl2_compat = 0; } #endif -- 2.25.1