From e80818e4f6e3791ec8240bda0a72eef999e4bf26 Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Sun, 12 Oct 2025 22:37:49 +0100 Subject: [PATCH] [tls] Disable renegotiation unless extended master secret is used RFC 7627 states that renegotiation becomes no longer secure under various circumstances when the non-extended master secret is used. The description of the precise set of circumstances is spread across various points within the document and is not entirely clear. Avoid a superset of the circumstances in which renegotiation apparently becomes insecure by refusing renegotiation completely unless the extended master secret is used. Signed-off-by: Michael Brown --- src/net/tls.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/net/tls.c b/src/net/tls.c index efecf368c..1d5a6c6d8 100644 --- a/src/net/tls.c +++ b/src/net/tls.c @@ -2082,7 +2082,7 @@ static int tls_new_hello_request ( struct tls_connection *tls, } /* Fail unless server supports secure renegotiation */ - if ( ! tls->secure_renegotiation ) { + if ( ! ( tls->secure_renegotiation && tls->extended_master_secret ) ) { DBGC ( tls, "TLS %p refusing to renegotiate insecurely\n", tls ); return -EPERM_RENEG_INSECURE;