Commit 6cef3a7f authored by Dr. Stephen Henson's avatar Dr. Stephen Henson
Browse files

Servers can't end up talking SSLv2 with legacy renegotiation disabled

parent 4d09323a

ssl/s23_srvr.c

+5 −0
Original line number Diff line number Diff line
@@ -488,6 +488,11 @@ int ssl23_get_client_hello(SSL *s) 
		SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,SSL_R_UNSUPPORTED_PROTOCOL);

		goto err;

#else

		if (!(s->ctx->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))

			{

			SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);

			goto err;

			}

		/* we are talking sslv2 */

		/* we need to clean up the SSLv3/TLSv1 setup and put in the

		 * sslv2 stuff. */