diff options
| author |   markus <markus@openbsd.org> | 2009-11-10 09:09:40 +0000 |
|---|---|---|
| committer | markus <markus@openbsd.org> | 2009-11-10 09:09:40 +0000 |
| commit | 66a15954f5845cbbe38e8561ce13fc3bb20b68b8 (patch) | |
| tree | f53091c24474a6910d6836e46486845d29db1196 /lib/libssl/src/ssl/s3_srvr.c | |
| parent | fix typo: in the example use ``rate'' instead of ``sample_rate'', (diff) | |
| download | wireguard-openbsd-66a15954f5845cbbe38e8561ce13fc3bb20b68b8.tar.xz wireguard-openbsd-66a15954f5845cbbe38e8561ce13fc3bb20b68b8.zip | |
pull Ben Lauries blind prefix injection fix for CVE-2009-3555 from
openssl 0.9.8l; crank minor version; ok djm@ deraadt@; initially from jsg@
Diffstat (limited to 'lib/libssl/src/ssl/s3_srvr.c')
| -rw-r--r-- | lib/libssl/src/ssl/s3_srvr.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/lib/libssl/src/ssl/s3_srvr.c b/lib/libssl/src/ssl/s3_srvr.c index 80b45eb86ff..79f3706c314 100644 --- a/lib/libssl/src/ssl/s3_srvr.c +++ b/lib/libssl/src/ssl/s3_srvr.c @@ -718,6 +718,14 @@ int ssl3_get_client_hello(SSL *s) #endif STACK_OF(SSL_CIPHER) *ciphers=NULL; + if (s->new_session + && !(s->s3->flags&SSL3_FLAGS_ALLOW_UNSAFE_LEGACY_RENEGOTIATION)) + { + al=SSL_AD_HANDSHAKE_FAILURE; + SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO, ERR_R_INTERNAL_ERROR); + goto f_err; + } + /* We do this so that we will respond with our native type. * If we are TLSv1 and we get SSLv3, we will respond with TLSv1, * This down switching should be handled by a different method. |