From 6851b10ec779772472f50415682abf635251c260 Mon Sep 17 00:00:00 2001 From: Hanno Becker Date: Thu, 12 Oct 2017 14:57:48 +0100 Subject: [PATCH] Note that disabling SSL_RENEGO doesn't open door for renego attack --- include/mbedtls/config.h | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/include/mbedtls/config.h b/include/mbedtls/config.h index 47c719640..69e997f85 100644 --- a/include/mbedtls/config.h +++ b/include/mbedtls/config.h @@ -1155,6 +1155,13 @@ * misuse/misunderstand. * * Comment this to disable support for renegotiation. + * + * \note Even if this option is disabled, both client and server are aware + * of the Renegotiation Indication Extension (RFC 5746) used to + * prevent the SSL renegotiation attack (see RFC 5746 Sect. 1). + * (See \c mbedtls_ssl_conf_legacy_renegotiation for the + * configuration of this extension). + * */ #define MBEDTLS_SSL_RENEGOTIATION