<html><head></head><body><div style="font-family: Verdana;font-size: 12.0px;"><div>
<div>Hello,</div>
<div> </div>
<div>I am referring to the DoS via repeated SSL session renegotiations (<a href="http://kalilinuxtutorials.com/thc-ssl-dos/" target="_blank">http://kalilinuxtutorials.com/thc-ssl-dos/</a>).</div>
<div> </div>
<div>Prior to OpenSSL 1.1.0 the approach to deactivate client renegotiation was to set the corresponding flag via a</div>
<div>callback function, e.g. :<br/>
---<br/>
SSL *connection;<br/>
...<br/>
connection->s3->flags |= SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS;<br/>
---</div>
<div> </div>
<div>The problem now is, that this approach does not work for OpenSSL 1.1.0, because the "flags" are not accessible any longer.</div>
<div>It also seems that there is no *_set_flags() function for deactivating client renegotiation.</div>
<div> </div>
<div>1) How can the client-renegotiation in OpenSSL generally be deactivated, preferably without accessing internal data structures as in the approach above?<br/>
2) Is it possible in OpenSSL 1.1.0 to access attributes like "flags" above? It seems that there is no dedicated API function for that.</div>
<div> </div>
<div>Thank you for your help!</div>
<div> </div>
<div>Best regards,<br/>
Marcus</div>
</div></div></body></html>