Does SSL perform automatic renegotiation - c++

Question

I have a client server application written in c++ using SSL 1.0.1n for socket communication. I am trying to prevent renegotiation (it's a requirement). Nowhere in my code do I initiate a renegotiation.
I see openssl has a BIO_set_ssl_renegotiate_bytes and BIO_set_ssl_renegotiate_timeout that allows you to set up automatic renegotiation after a certain number of bytes are read or a timeout.
My question is if I don't set a value for either one of these, do they have a default value where SSL will still initiate a renegotiate automatically? I am having trouble figuring out what causes a renegotiation if not done in code.

Answer 1

I am trying to prevent renegotiation (it's a requirement)
Hopefully that requirement isn't in response to CVE-2009-3555. That was fixed in OpenSSL 0.9.8k in Nov 2009. TLSv1.1 and later protocols have never been subject to that vulnerability.
However, you can still set the SSL_OP_NO_RENEGOTIATION option via SSL_CTX_set_options() or SSL_set_options:
SSL_CTX_set_options
NAME
SSL_CTX_set_options, SSL_set_options, SSL_CTX_clear_options,
SSL_clear_options, SSL_CTX_get_options, SSL_get_options,
SSL_get_secure_renegotiation_support - manipulate SSL options
SYNOPSIS
#include <openssl/ssl.h>
long SSL_CTX_set_options(SSL_CTX *ctx, long options);
long SSL_set_options(SSL *ssl, long options);
long SSL_CTX_clear_options(SSL_CTX *ctx, long options);
long SSL_clear_options(SSL *ssl, long options);
long SSL_CTX_get_options(SSL_CTX *ctx);
long SSL_get_options(SSL *ssl);
long SSL_get_secure_renegotiation_support(SSL *ssl);
DESCRIPTION
SSL_CTX_set_options() adds the options set via bitmask in options to
ctx. Options already set before are not cleared!
SSL_set_options() adds the options set via bitmask in options to ssl.
Options already set before are not cleared!
SSL_CTX_clear_options() clears the options set via bitmask in options
to ctx.
SSL_clear_options() clears the options set via bitmask in options to
ssl.
SSL_CTX_get_options() returns the options set for ctx.
SSL_get_options() returns the options set for ssl.
SSL_get_secure_renegotiation_support() indicates whether the peer
supports secure renegotiation. Note, this is implemented via a macro.
NOTES
The behaviour of the SSL library can be changed by setting several
options. The options are coded as bitmasks and can be combined by a
bitwise or operation (|).
SSL_CTX_set_options() and SSL_set_options() affect the (external)
protocol behaviour of the SSL library. The (internal) behaviour of the
API can be changed by using the similar SSL_CTX_set_mode and
SSL_set_mode() functions.
During a handshake, the option settings of the SSL object are used.
When a new SSL object is created from a context using SSL_new(), the
current option setting is copied. Changes to ctx do not affect already
created SSL objects. SSL_clear() does not affect the settings.
...
The following modifying options are available:
...
SSL_OP_NO_RENEGOTIATION
Disable all renegotiation in TLSv1.2 and earlier. Do not send
HelloRequest messages, and ignore renegotiation requests via
ClientHello.
SECURE RENEGOTIATION
...
Note that the page has a "SECURE RENEGOTIAION" section. Read it.
Then, you really need to review your requirements. There's a good chance they're a decade out-of-date. By having you spend time and effort on problems that were fixed a decade ago, you're not spending time and effort fixing addressing current issues.