Allow rehandshakes for server connections.

diff --git a/NEWS b/NEWS
index 9735d131d410cd5c8433e58bc8a0901f16cf5726..3f3c66399e1542a28d592d0d374be246c570ded1 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -15,6 +15,8 @@ NEWS
 - Add -a option, authentication for tlsproxy via basic digest authentication.
 - Add new debug level (-d 3) for even more debug output, including information
   about the current TLS session.
+- Allow rehandshakes for server connections (%SAFE_RENEGOTIATION is forced to
+  prevent issues).
 - Use pre-generated Diffie-Hellman parameters in proxy-dh.pem.
 - Code cleanup.
 - Better error handling.

diff --git a/src/connection.c b/src/connection.c
index 15eb321d811965d4f0b1a71c72659fb500a3d5ea..1fbbae57831f1464109380b4e5339df09e72710c 100644 (file)
--- a/src/connection.c
+++ b/src/connection.c
@@ -785,6 +785,18 @@ static int read_from_write_to_tls(gnutls_session_t from,
 
     size_read = gnutls_record_recv(from, buffer, buffer_size);
     if (size_read < 0) {
+        /* Allow rehandshakes. As handshakes might be insecure make sure that
+         * %SAFE_RENEGOTIATION is used in GnuTLS's priority string. */
+        if (size_read == GNUTLS_E_REHANDSHAKE) {
+            int result = gnutls_handshake(from);
+            if (result != GNUTLS_E_SUCCESS) {
+                LOG(WARNING, "server TLS rehandshake failed: %s",
+                             gnutls_strerror(result));
+                return -1;
+            }
+            return 0;
+        }
+
         LOG(WARNING, "read_from_write_to_tls(): gnutls_record_recv(): %s",
                      gnutls_strerror((int)size_read));
         return -1;

diff --git a/src/tlsproxy.h b/src/tlsproxy.h
index 33df814f622331f3b6ab464858fd749c19758f26..4664428fe862be1f5ce02bde348399b037667b8d 100644 (file)
--- a/src/tlsproxy.h
+++ b/src/tlsproxy.h
@@ -55,7 +55,12 @@
     /* Don't use known insecure algorithms. */ \
     "SECURE" \
     /* Lower priority of SHA-1, user better hashes if possible. */ \
-    ":-SHA1:+SHA1"
+    ":-SHA1:+SHA1" \
+    /* Force safe renegotiations. Shouldn't cause any problems as this \
+     * option only affects the server side (with GnuTLS defaults) and the \
+     * local clients most-likely already support safe renegotiations (old \
+     * servers are therefore not an issue). */ \
+    ":%SAFE_RENEGOTIATION"
 
 
 /* Proxy hostname and port if specified on the command line. */