From 30fbdc740e9b8282721fd02447f00078ccfba010 Mon Sep 17 00:00:00 2001 From: Pavel Punsky Date: Sun, 14 Aug 2022 16:55:02 -0700 Subject: [PATCH] Disable SSL renegotiation --- src/apps/relay/dtls_listener.c | 5 +++-- src/apps/relay/ns_ioalib_engine_impl.c | 1 + 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/src/apps/relay/dtls_listener.c b/src/apps/relay/dtls_listener.c index 9a5698c..2839428 100644 --- a/src/apps/relay/dtls_listener.c +++ b/src/apps/relay/dtls_listener.c @@ -295,7 +295,7 @@ static ioa_socket_handle dtls_server_input_handler(dtls_listener_relay_server_ty SSL_set_accept_state(connecting_ssl); SSL_set_bio(connecting_ssl, NULL, wbio); - SSL_set_options(connecting_ssl, SSL_OP_COOKIE_EXCHANGE); + SSL_set_options(connecting_ssl, SSL_OP_COOKIE_EXCHANGE | SSL_OP_NO_RENEGOTIATION); SSL_set_max_cert_list(connecting_ssl, 655350); @@ -581,7 +581,8 @@ static int create_new_connected_udp_socket( SSL_set_bio(connecting_ssl, NULL, wbio); - SSL_set_options(connecting_ssl, SSL_OP_COOKIE_EXCHANGE); + SSL_set_options(connecting_ssl, SSL_OP_COOKIE_EXCHANGE | SSL_OP_NO_RENEGOTIATION); + SSL_set_max_cert_list(connecting_ssl, 655350); int rc = ssl_read(ret->fd, connecting_ssl, server->sm.m.sm.nd.nbh, server->verbose); diff --git a/src/apps/relay/ns_ioalib_engine_impl.c b/src/apps/relay/ns_ioalib_engine_impl.c index 25a041d..a84e2e0 100644 --- a/src/apps/relay/ns_ioalib_engine_impl.c +++ b/src/apps/relay/ns_ioalib_engine_impl.c @@ -1428,6 +1428,7 @@ static void set_socket_ssl(ioa_socket_handle s, SSL *ssl) if(ssl) { SSL_set_app_data(ssl,s); SSL_set_info_callback(ssl, (ssl_info_callback_t)ssl_info_callback); + SSL_set_options(ssl, SSL_OP_NO_RENEGOTIATION); } } }