From: Sergey Kandaurov <pluknet@nginx.com>
Date: Wed, 3 May 2017 12:15:56 +0000 (+0300)
Subject: SSL: allowed renegotiation in client mode with OpenSSL < 1.1.0.
X-Git-Tag: release-1.13.1~18
X-Git-Url: http://www.kaiwu.me/postgresql/commit/?a=commitdiff_plain;h=99611988792cbc6a3355bb169bbc797bb6d6310f;p=nginx.git

SSL: allowed renegotiation in client mode with OpenSSL < 1.1.0.

In ac9b1df5b246 (1.13.0) we attempted to allow renegotiation in client mode,
but when using OpenSSL 1.0.2 or older versions it was additionally disabled
by SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS.
---

diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
index fdbd0c95d..2c4e11400 100644
--- a/src/event/ngx_event_openssl.c
+++ b/src/event/ngx_event_openssl.c
@@ -1300,7 +1300,7 @@ ngx_ssl_handshake(ngx_connection_t *c)
 #ifdef SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS
 
         /* initial handshake done, disable renegotiation (CVE-2009-3555) */
-        if (c->ssl->connection->s3) {
+        if (c->ssl->connection->s3 && SSL_is_server(c->ssl->connection)) {
             c->ssl->connection->s3->flags |= SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS;
         }