Commit 423c66f1 authored by Dr. Stephen Henson's avatar Dr. Stephen Henson
Browse files

Simplify RI+SCSV logic: 

1. Send SCSV is not renegotiating, never empty RI.
2. Send RI if renegotiating.
parent 74f22606

ssl/ssl_lib.c

+2 −3
Original line number Original line Diff line number Diff line
@@ -1370,10 +1370,9 @@ int ssl_cipher_list_to_bytes(SSL *s,STACK_OF(SSL_CIPHER) *sk,unsigned char *p, 
		p+=j;

		p+=j;

		}

		}

	/* If p == q, no ciphers and caller indicates an error. Otherwise

	/* If p == q, no ciphers and caller indicates an error. Otherwise

	 * add SCSV if no extensions (i.e. SSL3 is client_version)

	 * add SCSV if not renegotiating.

	 * since spec RECOMMENDS not sending both RI and SCSV.

	 */

	 */

	if (p != q && !s->new_session && s->client_version == SSL3_VERSION)

	if (p != q && !s->new_session)

		{

		{

		static SSL_CIPHER scsv =

		static SSL_CIPHER scsv =

			{

			{

ssl/t1_lib.c

+3 −2
Original line number Original line Diff line number Diff line
@@ -316,7 +316,8 @@ unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned cha 
		ret+=size_str;

		ret+=size_str;

		}

		}





        /* Add the renegotiation option: TODOEKR switch */

        /* Add RI if renegotiating */

        if (s->new_session)

          {

          {

          int el;

          int el;