Commit b50ef8b2 authored by Dr. Stephen Henson's avatar Dr. Stephen Henson
Browse files

PR: 2171 

Submitted by: Tomas Mraz <tmraz@redhat.com>

Since SSLv2 doesn't support renegotiation at all don't reject it if
legacy renegotiation isn't enabled.

Also can now use SSL2 compatible client hello because RFC5746 supports it.
parent 1b690c1a

ssl/s23_clnt.c

+0 −2
Original line number Diff line number Diff line
@@ -235,8 +235,6 @@ static int ssl23_client_hello(SSL *s) 
			ssl2_compat = 0;

		if (s->tlsext_status_type != -1)

			ssl2_compat = 0;

		if (!(s->ctx->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))

			ssl2_compat = 0;

		}

#endif

ssl/s23_srvr.c

+0 −5
Original line number Diff line number Diff line
@@ -493,11 +493,6 @@ int ssl23_get_client_hello(SSL *s) 
		SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,SSL_R_UNSUPPORTED_PROTOCOL);

		goto err;

#else

		if (!(s->ctx->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))

			{

			SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);

			goto err;

			}

		/* we are talking sslv2 */

		/* we need to clean up the SSLv3/TLSv1 setup and put in the

		 * sslv2 stuff. */