Don't use SSLv2 compatible client hello if we don't tolerate legacy renegotiation

4d09323a · Dr. Stephen Henson · 64abf5e6 · 4d09323a
隐藏空白更改
内联并排

Showing with 2 addition and 0 deletion

ssl/s23_clnt.c ssl/s23_clnt.c +2 -0

未找到文件。
--- a/ssl/s23_clnt.c
+++ b/ssl/s23_clnt.c
@@ -305,6 +305,8 @@ static int ssl23_client_hello(SSL *s)
 			ssl2_compat = 0;
 		if (s->tlsext_status_type != -1)
 			ssl2_compat = 0;
+		if (!(s->ctx->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
+			ssl2_compat = 0;
 		
 #ifdef TLSEXT_TYPE_opaque_prf_input
 		if (s->ctx->tlsext_opaque_prf_input_callback != 0 || s->tlsext_opaque_prf_input != NULL)