When denying an initial negotiation due to missing safe renegotiation

extension reply with NO_RENEGOTIATION alert.

diff --git a/lib/gnutls_handshake.c b/lib/gnutls_handshake.c
index 3620a2991a28548c1a431db016cd2e42c658c68a..41a9f0e8ff0b59d13eed69e480e7158bb14dbdb1 100644 (file)
--- a/lib/gnutls_handshake.c
+++ b/lib/gnutls_handshake.c
@@ -2430,6 +2430,15 @@ _gnutls_recv_hello (gnutls_session_t session, opaque * data, int datalen)
            {
              gnutls_assert();
              _gnutls_handshake_log ("Denying unsafe renegotiation.\n");
+             ret = gnutls_alert_send (session, GNUTLS_AL_WARNING,
+                                  GNUTLS_A_NO_RENEGOTIATION);
+
+             if (ret < 0)
+               {
+                 gnutls_assert ();
+                 return ret;
+               }
+
              return GNUTLS_E_SAFE_RENEGOTIATION_FAILED;
            }
        }