PR: 2171
authorDr. Stephen Henson <steve@openssl.org>
Tue, 16 Feb 2010 14:21:11 +0000 (14:21 +0000)
committerDr. Stephen Henson <steve@openssl.org>
Tue, 16 Feb 2010 14:21:11 +0000 (14:21 +0000)
Submitted by: Tomas Mraz <tmraz@redhat.com>

Since SSLv2 doesn't support renegotiation at all don't reject it if
legacy renegotiation isn't enabled.

Also can now use SSL2 compatible client hello because RFC5746 supports it.

ssl/s23_clnt.c
ssl/s23_srvr.c

index b2a3eb0..e6f9bf9 100644 (file)
@@ -311,9 +311,6 @@ static int ssl23_client_hello(SSL *s)
                        ssl2_compat = 0;
                if (s->tlsext_status_type != -1)
                        ssl2_compat = 0;
-               if (!(s->ctx->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
-                       ssl2_compat = 0;
-               
 #ifdef TLSEXT_TYPE_opaque_prf_input
                if (s->ctx->tlsext_opaque_prf_input_callback != 0 || s->tlsext_opaque_prf_input != NULL)
                        ssl2_compat = 0;
index 05e4e0b..390b99b 100644 (file)
@@ -509,11 +509,6 @@ int ssl23_get_client_hello(SSL *s)
                SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,SSL_R_UNSUPPORTED_PROTOCOL);
                goto err;
 #else
-               if (!(s->ctx->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
-                       {
-                       SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
-                       goto err;
-                       }
                /* we are talking sslv2 */
                /* we need to clean up the SSLv3/TLSv1 setup and put in the
                 * sslv2 stuff. */