diff options
| author | Todd Short <tshort@akamai.com> | 2017-05-10 16:46:14 -0400 |
|---|---|---|
| committer | Matt Caswell <matt@openssl.org> | 2017-06-06 22:39:41 +0100 |
| commit | db0f35dda18403accabe98e7780f3dfc516f49de (patch) | |
| tree | 68a7b32f8f99c5624e2d0bb1089f6bf34047f01f /apps | |
| parent | 270d65fa34caa974fb27c9b161b0c9b6cd806c76 (diff) | |
Fix #2400 Add NO_RENEGOTIATE option
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3432)
Diffstat (limited to 'apps')
| -rw-r--r-- | apps/apps.h | 5 | ||||
| -rw-r--r-- | apps/s_server.c | 3 |
2 files changed, 7 insertions, 1 deletions
diff --git a/apps/apps.h b/apps/apps.h index 3c1da48ff8..31cf7b0961 100644 --- a/apps/apps.h +++ b/apps/apps.h @@ -215,7 +215,7 @@ int set_cert_times(X509 *x, const char *startdate, const char *enddate, OPT_S_ONRESUMP, OPT_S_NOLEGACYCONN, OPT_S_STRICT, OPT_S_SIGALGS, \ OPT_S_CLIENTSIGALGS, OPT_S_GROUPS, OPT_S_CURVES, OPT_S_NAMEDCURVE, \ OPT_S_CIPHER, OPT_S_DHPARAM, OPT_S_RECORD_PADDING, OPT_S_DEBUGBROKE, \ - OPT_S_COMP, OPT_S__LAST + OPT_S_COMP, OPT_S_NO_RENEGOTIATION, OPT_S__LAST # define OPT_S_OPTIONS \ {"no_ssl3", OPT_S_NOSSL3, '-',"Just disable SSLv3" }, \ @@ -231,6 +231,8 @@ int set_cert_times(X509 *x, const char *startdate, const char *enddate, {"serverpref", OPT_S_SERVERPREF, '-', "Use server's cipher preferences"}, \ {"legacy_renegotiation", OPT_S_LEGACYRENEG, '-', \ "Enable use of legacy renegotiation (dangerous)"}, \ + {"no_renegotiation", OPT_S_NO_RENEGOTIATION, '-', \ + "Disable all renegotiation."}, \ {"legacy_server_connect", OPT_S_LEGACYCONN, '-', \ "Allow initial connection to servers that don't support RI"}, \ {"no_resumption_on_reneg", OPT_S_ONRESUMP, '-', \ @@ -284,6 +286,7 @@ int set_cert_times(X509 *x, const char *startdate, const char *enddate, case OPT_S_CIPHER: \ case OPT_S_DHPARAM: \ case OPT_S_RECORD_PADDING: \ + case OPT_S_NO_RENEGOTIATION: \ case OPT_S_DEBUGBROKE #define IS_NO_PROT_FLAG(o) \ diff --git a/apps/s_server.c b/apps/s_server.c index 82fe5a4b74..d678e8e257 100644 --- a/apps/s_server.c +++ b/apps/s_server.c @@ -2785,6 +2785,9 @@ static void print_connection_info(SSL *con) BIO_printf(bio_s_out, "Reused session-id\n"); BIO_printf(bio_s_out, "Secure Renegotiation IS%s supported\n", SSL_get_secure_renegotiation_support(con) ? "" : " NOT"); + if ((SSL_get_options(con) & SSL_OP_NO_RENEGOTIATION)) + BIO_printf(bio_s_out, "Renegotiation is DISABLED\n"); + if (keymatexportlabel != NULL) { BIO_printf(bio_s_out, "Keying material exporter:\n"); BIO_printf(bio_s_out, " Label: '%s'\n", keymatexportlabel); |