From 27cb384679154b050f1008c0382e8345b7abbc41 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=A9r=C3=A9my=20Rocher?= Date: Fri, 9 Nov 2018 14:05:26 +0100 Subject: openssl: support BoringSSL TLS renegotiation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit As per BoringSSL porting documentation [1], BoringSSL rejects peer renegotiations by default. curl fails when trying to authenticate to server through client certificate if it is requested by server after the initial TLS handshake. Enable renegotiation by default with BoringSSL to get same behavior as with OpenSSL. This is done by calling SSL_set_renegotiate_mode [2] which was introduced in commit 1d5ef3bb1eb9 [3]. 1 - https://boringssl.googlesource.com/boringssl/+/HEAD/PORTING.md#tls-renegotiation 2 - https://boringssl.googlesource.com/boringssl/+/master/include/openssl/ssl.h#3482 3 - https://boringssl.googlesource.com/boringssl/+/1d5ef3bb1eb97848617db5e7d633d735a401df86 Signed-off-by: Jérémy Rocher Fixes #3258 Closes #3259 --- lib/vtls/openssl.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c index 4c5e8c19c..7c30ab373 100644 --- a/lib/vtls/openssl.c +++ b/lib/vtls/openssl.c @@ -2610,6 +2610,10 @@ static CURLcode ossl_connect_step1(struct connectdata *conn, int sockindex) SSL_set_tlsext_status_type(BACKEND->handle, TLSEXT_STATUSTYPE_ocsp); #endif +#ifdef OPENSSL_IS_BORINGSSL + SSL_set_renegotiate_mode(BACKEND->handle, ssl_renegotiate_freely); +#endif + SSL_set_connect_state(BACKEND->handle); BACKEND->server_cert = 0x0; -- cgit v1.2.3