From 78b9d13474e843205307da96ef348868fe6d71bb Mon Sep 17 00:00:00 2001 From: Matt Caswell Date: Tue, 10 Nov 2015 15:17:42 +0000 Subject: Stop DTLS servers asking for unsafe legacy renegotiation If a DTLS client that does not support secure renegotiation connects to an OpenSSL DTLS server then, by default, renegotiation is disabled. If a server application attempts to initiate a renegotiation then OpenSSL is supposed to prevent this. However due to a discrepancy between the TLS and DTLS code, the server sends a HelloRequest anyway in DTLS. This is not a security concern because the handshake will still fail later in the process when the client responds with a ClientHello. Reviewed-by: Tim Hudson (cherry picked from commit d40ec4ab8e7c0ff39bf4f9918fbb9dfdca4c5221) --- ssl/d1_srvr.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/ssl/d1_srvr.c b/ssl/d1_srvr.c index d716f0aca5..f01b8a693f 100644 --- a/ssl/d1_srvr.c +++ b/ssl/d1_srvr.c @@ -267,6 +267,19 @@ int dtls1_accept(SSL *s) ssl3_init_finished_mac(s); s->state = SSL3_ST_SR_CLNT_HELLO_A; s->ctx->stats.sess_accept++; + } else if (!s->s3->send_connection_binding && + !(s->options & + SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION)) { + /* + * Server attempting to renegotiate with client that doesn't + * support secure renegotiation. + */ + SSLerr(SSL_F_DTLS1_ACCEPT, + SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED); + ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE); + ret = -1; + s->state = SSL_ST_ERR; + goto end; } else { /* * s->state == SSL_ST_RENEGOTIATE, we will just send a -- cgit v1.2.3