Added support for client certificates (both client-side and server-side, but still...

[BearSSL] / src / ssl / ssl_engine.c

diff --git a/src/ssl/ssl_engine.c b/src/ssl/ssl_engine.c
index 8af773d..32bc406 100644 (file)
--- a/src/ssl/ssl_engine.c
+++ b/src/ssl/ssl_engine.c
@@ -880,6 +880,12 @@ sendpld_ack(br_ssl_engine_context *rc, size_t len)
        }
        rc->oxa += len;
        if (rc->oxa >= rc->oxb) {
+               /*
+                * Set oxb to one more than oxa so that sendpld_flush()
+                * does not mistakingly believe that a record is
+                * already prepared and being sent.
+                */
+               rc->oxb = rc->oxa + 1;
                sendpld_flush(rc, 0);
        }
 }
@@ -1233,7 +1239,9 @@ br_ssl_engine_close(br_ssl_engine_context *cc)
 int
 br_ssl_engine_renegotiate(br_ssl_engine_context *cc)
 {
-       if (br_ssl_engine_closed(cc) || cc->reneg == 1) {
+       if (br_ssl_engine_closed(cc) || cc->reneg == 1
+               || (cc->flags & BR_OPT_NO_RENEGOTIATION) != 0)
+       {
                return 0;
        }
        jump_handshake(cc, 2);