commit de167d452196e27b85f1701c299f1a05edb26610
author Sergey Kandaurov <pluknet@nginx.com> Wed May 03 15:15:56 2017 +0300
committer Sergey Kandaurov <pluknet@nginx.com> Wed May 03 15:15:56 2017 +0300
tree 583686df5f8f963e618c03b45cefb43ae617d99b
parent 704bcc800ead6348b8ea36796b257c18e6cf9cae

SSL: allowed renegotiation in client mode with OpenSSL < 1.1.0.

In ac9b1df5b246 (1.13.0) we attempted to allow renegotiation in client mode,
but when using OpenSSL 1.0.2 or older versions it was additionally disabled
by SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS.

src/event/ngx_event_openssl.c

diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
index fdbd0c9..2c4e114 100644
--- a/src/event/ngx_event_openssl.c
+++ b/src/event/ngx_event_openssl.c
@@ -1300,7 +1300,7 @@
 #ifdef SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS
 
         /* initial handshake done, disable renegotiation (CVE-2009-3555) */
-        if (c->ssl->connection->s3) {
+        if (c->ssl->connection->s3 && SSL_is_server(c->ssl->connection)) {
             c->ssl->connection->s3->flags |= SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS;
         }