Hi, I am using openssl 0.9.8q and I am seeing following behavior:
client sends SSL3_CK_SCSV for indicating the support of secure renegotiation server on receiving this cipher sets send_connection_binding to true server in response sends empty renegotiation extension client parses the extension and sets send_connection_binding to true Both server and client perform subsequent handshake securely According to RFC 5746 client can also send empty renegotiation extension (just like server). I do see the code to do it but it is never invoked (mainly because send_connection_binding is not set when ssl_add_clienthello_tlsext is called) when sending the first client hello. Openssl by default sends SCSV cipher to indicate support. Now my question is: --- how to disable sending cipher suite and enable sending empty extension in the first client hello ? Secondly, the current approach seems to break secure inline renegotiation in case of unpatched server and patched client. I did testing where my server was 0.9.8g (with no extension support) and my client was 0.9.8q. In this case client sends SCSV server ignores that cipher suite. Since extensions are not compiled server hello doesn't include any extension in server hello Since client doesn't receive any extensions it doesn't set the send_connection_binding to true This results in legacy renegotiation (both client and server doesn't set the flag to true). It seems to me that we need to set send_connection_binding to true before sending client hello to suggest that we support secure inline re-negotiation irrespective of what server supports... Can some one please comment on this. Did I mis-read the code ? Thanks, Kunal
