diff options
| author | jsing <> | 2026-06-14 14:25:55 +0000 |
|---|---|---|
| committer | jsing <> | 2026-06-14 14:25:55 +0000 |
| commit | 299a1344c51031d924e952fa2df617b31de379db (patch) | |
| tree | 66d38a628797029d8fe4ac017628c5759db894a6 /src/lib/libc | |
| parent | 38befe6989390abba9a0b8a347ca4922ab7d7992 (diff) | |
| download | openbsd-299a1344c51031d924e952fa2df617b31de379db.tar.gz openbsd-299a1344c51031d924e952fa2df617b31de379db.tar.bz2 openbsd-299a1344c51031d924e952fa2df617b31de379db.zip | |
Remove SSL_OP_LEGACY_SERVER_CONNECT from default options.
Remove SSL_OP_LEGACY_SERVER_CONNECT from the default SSL options and the
SSL_OP_ALL define. This means that we will now refuse to connect to a
TLSv1.2 server if it does not support the Renegotiation Indication (RI)
extension. This prevents a class of attacks against TLS clients that are
talking to TLSv1.2-only servers that permit client initiated renegotiation.
Raised by Lucca Hirschi et al from Inria.
ok beck@ tb@
Diffstat (limited to 'src/lib/libc')
0 files changed, 0 insertions, 0 deletions