From: Todd Short <tshort@akamai.com>
Date: Mon, 22 May 2017 15:24:59 +0000 (-0400)
Subject: Fix inconsistent check of UNSAFE_LEGACY_RENEGOTIATION
X-Git-Tag: OpenSSL_1_1_1-pre1~1438
X-Git-Url: https://git.openssl.org/?p=openssl.git;a=commitdiff_plain;h=dffdcc773ac0a294b1ce620131cb8d7401da9408;hp=418bb7b31bb7cfca6e419a5aa7bf161784f61059

Fix inconsistent check of UNSAFE_LEGACY_RENEGOTIATION

The check for SSL3_FLAGS_ALLOW_UNSAFE_LEGACY_RENEGOTIATION is
inconsistent. Most places check SSL->options, one place is checking
SSL_CTX->options; fix that.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
GH: #3523
---

diff --git a/ssl/record/rec_layer_s3.c b/ssl/record/rec_layer_s3.c
index fbabdf48c5..01caf4c372 100644
--- a/ssl/record/rec_layer_s3.c
+++ b/ssl/record/rec_layer_s3.c
@@ -1439,7 +1439,7 @@ int ssl3_read_bytes(SSL *s, int type, int *recvd_type, unsigned char *buf,
         (s->rlayer.handshake_fragment_len >= 4) &&
         (s->rlayer.handshake_fragment[0] == SSL3_MT_CLIENT_HELLO) &&
         (s->session != NULL) && (s->session->cipher != NULL) &&
-        !(s->ctx->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION)) {
+        !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION)) {
         SSL3_RECORD_set_length(rr, 0);
         SSL3_RECORD_set_read(rr);
         ssl3_send_alert(s, SSL3_AL_WARNING, SSL_AD_NO_RENEGOTIATION);