commit d0f6fa7bdc1a2c6539165ed044b9c85a109afaf1
author Paul Bakker <p.j.bakker@polarssl.org> Mon Sep 17 09:18:12 2012 +0000
committer Paul Bakker <p.j.bakker@polarssl.org> Mon Sep 17 09:18:12 2012 +0000
tree 6160065a461003563222caf03369263b79e2e35e
parent 17a97909188bb529acf7fa2db2d582e7b489b89e

 - Sending of handshake_failures during renegotiation added
 - Handle two legacy modes differently: SSL_LEGACY_BREAK_HANDSHAKE and SSL_LEGACY_NO_RENEGOTIATION

library/ssl_tls.c

diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index d47ec9f..7e638cd 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -2020,6 +2020,20 @@
     return( 0 );
 }
 
+int ssl_send_fatal_handshake_failure( ssl_context *ssl )
+{
+    int ret;
+
+    if( ( ret = ssl_send_alert_message( ssl,
+                    SSL_ALERT_LEVEL_FATAL,
+                    SSL_ALERT_MSG_HANDSHAKE_FAILURE ) ) != 0 )
+    {
+        return( ret );
+    }
+
+    return( 0 );
+}
+
 int ssl_send_alert_message( ssl_context *ssl,
                             unsigned char level,
                             unsigned char message )
@@ -3513,15 +3527,28 @@
                 return( POLARSSL_ERR_SSL_UNEXPECTED_MESSAGE );
             }
 
-            if( ssl->disable_renegotiation == SSL_RENEGOTIATION_DISABLED )
+            if( ssl->disable_renegotiation == SSL_RENEGOTIATION_DISABLED ||
+                ( ssl->secure_renegotiation == SSL_LEGACY_RENEGOTIATION &&
+                  ssl->allow_legacy_renegotiation == SSL_LEGACY_NO_RENEGOTIATION ) )
             {
                 SSL_DEBUG_MSG( 3, ( "ignoring renegotiation, sending alert" ) );
 
-                if( ( ret = ssl_send_alert_message( ssl,
-                                SSL_ALERT_LEVEL_WARNING,
-                                SSL_ALERT_MSG_NO_RENEGOTIATION ) ) != 0 )
+                if( ssl->minor_ver == SSL_MINOR_VERSION_0 )
                 {
-                    return( ret );
+                    /*
+                     * SSLv3 does not have a "no_renegotiation" alert
+                     */
+                    if( ( ret = ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
+                        return( ret );
+                }
+                else
+                {
+                    if( ( ret = ssl_send_alert_message( ssl,
+                                    SSL_ALERT_LEVEL_WARNING,
+                                    SSL_ALERT_MSG_NO_RENEGOTIATION ) ) != 0 )
+                    {
+                        return( ret );
+                    }
                 }
             }
             else