Implement (partial) renego delay on client
diff --git a/library/ssl_cli.c b/library/ssl_cli.c
index 089b7c9..38f9fe7 100644
--- a/library/ssl_cli.c
+++ b/library/ssl_cli.c
@@ -904,6 +904,16 @@
{
if( ssl->renegotiation == SSL_RENEGOTIATION )
{
+ ssl->renego_records_seen++;
+
+ if( ssl->renego_max_records >= 0 &&
+ ssl->renego_records_seen > ssl->renego_max_records )
+ {
+ SSL_DEBUG_MSG( 1, ( "renegotiation requested, "
+ "but not honored by server" ) );
+ return( POLARSSL_ERR_SSL_UNEXPECTED_MESSAGE );
+ }
+
SSL_DEBUG_MSG( 1, ( "non-handshake message during renego" ) );
return( POLARSSL_ERR_SSL_WAITING_SERVER_HELLO_RENEGO );
}