Provide SSL_OP_NO_RENEGOTIATION and SSL_OP_ALLOW_CLIENT_RENEGOTIATION.

In January 2017 we added SSL_OP_NO_CLIENT_RENEGOTIATION, which results in a
SSL_AD_NO_RENEGOTIATION fatal alert if a ClientHello message is seen on an
active connection (client initiated renegotation). Then in May 2017 OpenSSL
added SSL_OP_NO_RENEGOTIATION, which results in a SSL_AD_NO_RENEGOTIATION
warning alert if a server receives a ClientHello on an active connection
(client initiated renegotation), or a client receives a HelloRequest
(server requested renegotation). This option also causes calls to
SSL_renegotiate() and SSL_renegotiate_abbreviated() to fail. Then in 2021,
OpenSSL also added SSL_OP_ALLOW_CLIENT_RENEGOTIATION, which trumps
SSL_OP_NO_RENEGOTIATION but only for incoming ClientHello messages
(apparently unsetting SSL_OP_NO_RENEGOTIATION is too hard).

Provide SSL_OP_NO_RENEGOTIATION and SSL_OP_ALLOW_CLIENT_RENEGOTIATION,
primarily to make life easier for ports. If SSL_OP_NO_CLIENT_RENEGOTIATION
is set it will take precedence and render SSL_OP_ALLOW_CLIENT_RENEGOTIATION
ineffective. The rest of the behaviour should match OpenSSL, with the
exception of ClientHellos triggering fatal alerts instead of warnings.

ok tb@

1 files changed, 10 insertions, 2 deletions

diff --git a/src/lib/libssl/ssl_pkt.c b/src/lib/libssl/ssl_pkt.c
index 740fe97192..7032175aac 100644
--- a/src/lib/libssl/ssl_pkt.c
+++ b/src/lib/libssl/ssl_pkt.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_pkt.c,v 1.68 2024/07/22 14:47:15 jsing Exp $ */
+/* $OpenBSD: ssl_pkt.c,v 1.69 2025/03/12 14:03:55 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -900,6 +900,12 @@ ssl3_read_handshake_unexpected(SSL *s)
                 tls_buffer_free(s->s3->handshake_fragment);
                 s->s3->handshake_fragment = NULL;
 
+                if ((s->options & SSL_OP_NO_RENEGOTIATION) != 0) {
+                        ssl3_send_alert(s, SSL3_AL_WARNING,
+                            SSL_AD_NO_RENEGOTIATION);
+                        return 1;
+                }
+
                 /*
                  * It should be impossible to hit this, but keep the safety
                  * harness for now...
@@ -947,7 +953,9 @@ ssl3_read_handshake_unexpected(SSL *s)
                         return -1;
                 }
 
-                if ((s->options & SSL_OP_NO_CLIENT_RENEGOTIATION) != 0) {
+                if ((s->options & SSL_OP_NO_CLIENT_RENEGOTIATION) != 0 ||
+                    ((s->options & SSL_OP_NO_RENEGOTIATION) != 0 &&
+                    (s->options & SSL_OP_ALLOW_CLIENT_RENEGOTIATION) == 0)) {
                         ssl3_send_alert(s, SSL3_AL_FATAL,
                             SSL_AD_NO_RENEGOTIATION);
                         return -1;