Re: [9front] [PATCH] libsec: add minimal support for the tls renegotiation extension

[ori@eigenstate.org]

Quoth Anthony Martin <ality@pbrane.org>:
> OpenSSL 3.0 clients refuse to connect to servers that do not
> support the renegotiation extension (RFC 5746) unless the default
> configuration is changed to allow it. Since we do not support
> renegotiation, we only need to make minor changes to the initial
> handshake to comply with the specification:
> 
> 1. For tlsClient, simply add the proper SCSV to the ClientHello
> cipher list (cf. RFC 5746 § 3.3);
> 
> 2. For tlsServer, respond with an empty renegotiation extension
> in the ServerHello if we received either the SCSV or an empty
> renegotiation extension in the ClientHello.
> 
> Since we close the hand file and never open it after the initial
> handshake, we can rely on tls(3) to send the "no renegotiation"
> alerts if subsequent handshake records are received.
> 

looks good; running this on shithub, will probably commit in the
next day or two assuming I don't run into problems.

thanks!