Move notifySecureRenegotiation into TlsPeer and have both client and

server default to handshake_failure if secure_renegotiation is false.

1 files changed, 12 insertions, 0 deletions

diff --git a/core/src/main/java/org/bouncycastle/crypto/tls/AbstractTlsPeer.java b/core/src/main/java/org/bouncycastle/crypto/tls/AbstractTlsPeer.java
index 4ea86cca..80d6af73 100644
--- a/core/src/main/java/org/bouncycastle/crypto/tls/AbstractTlsPeer.java
+++ b/core/src/main/java/org/bouncycastle/crypto/tls/AbstractTlsPeer.java
@@ -5,6 +5,18 @@ import java.io.IOException;
 public abstract class AbstractTlsPeer
     implements TlsPeer
 {
+    public void notifySecureRenegotiation(boolean secureRenegotiation) throws IOException
+    {
+        if (!secureRenegotiation)
+        {
+            /*
+             * RFC 5746 3.4/3.6. In this case, some clients/servers may want to terminate the handshake instead
+             * of continuing; see Section 4.1/4.3 for discussion.
+             */
+            throw new TlsFatalAlert(AlertDescription.handshake_failure);
+        }
+    }
+
     public void notifyAlertRaised(short alertLevel, short alertDescription, String message, Exception cause)
     {
     }