From 6ae9770d34c2a90c54c345821b12e938dcc5c634 Mon Sep 17 00:00:00 2001 From: "Dr. Stephen Henson" Date: Thu, 18 Feb 2010 12:42:03 +0000 Subject: [PATCH] clarify documentation --- doc/ssl/SSL_CTX_set_options.pod | 38 ++++++++++++++++++++++----------- 1 file changed, 25 insertions(+), 13 deletions(-) diff --git a/doc/ssl/SSL_CTX_set_options.pod b/doc/ssl/SSL_CTX_set_options.pod index e87517de97..06025d13fa 100644 --- a/doc/ssl/SSL_CTX_set_options.pod +++ b/doc/ssl/SSL_CTX_set_options.pod @@ -225,10 +225,16 @@ is explicitly set when OpenSSL is compiled. If this option is set this functionality is disabled and tickets will not be used by clients or servers. -=item SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION, SSL_OP_LEGACY_SERVER_CONNECT +=item SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION -See the B section for a discussion of the purpose of -these options. +Allow legacy insecure renegotiation between OpenSSL and unpatched clients or +servers. See the B section for more details. + +=item SSL_OP_LEGACY_SERVER_CONNECT + +Allow legacy insecure renegotiation between OpenSSL and unpatched servers +B: this option is currently set by default. See the +B section for more details. =back @@ -276,15 +282,18 @@ was refused. =head2 Patched OpenSSL client and unpatched server. -If the option B is set then initial connections +If the option B or +B is set then initial connections and renegotiation between patched OpenSSL clients and unpatched servers -succeeds. +succeeds. If neither option is set then initial connections to unpatched +servers will fail. -This option is currently set by default even though it has security -implications: otherwise it would be impossible to connect to unpatched servers -(i.e. all of them initially) and this is clearly not acceptable. Renegotiation -is permitted because this does not add any additional security issues: during -an attack clients do not see any renegotiations anyway. +The option B is currently set by default even +though it has security implications: otherwise it would be impossible to +connect to unpatched servers (i.e. all of them initially) and this is clearly +not acceptable. Renegotiation is permitted because this does not add any +additional security issues: during an attack clients do not see any +renegotiations anyway. As more servers become patched the option B will B be set by default in a future version of OpenSSL. @@ -297,9 +306,12 @@ unpatched servers (and thus avoid any security issues) should always B B using SSL_CTX_clear_options() or SSL_clear_options(). -As in the previous case if the option -B is set then renegotiation -B succeeds. +The difference between the B and +B options is that +B enables initial connections and secure +renegotiation between OpenSSL clients and unpatched servers B, while +B allows initial connections +and renegotiation between OpenSSL and unpatched clients or servers. =head1 RETURN VALUES -- 2.25.1