Commit 6dd54739 authored by Dr. Stephen Henson's avatar Dr. Stephen Henson
Browse files

use client version when eliminating TLS v1.2 ciphersuites in client hello

parent 66bb328e

ssl/ssl_lib.c

+1 −1
Original line number Original line Diff line number Diff line
@@ -1381,7 +1381,7 @@ int ssl_cipher_list_to_bytes(SSL *s,STACK_OF(SSL_CIPHER) *sk,unsigned char *p, 
		c=sk_SSL_CIPHER_value(sk,i);

		c=sk_SSL_CIPHER_value(sk,i);

		/* Skip TLS v1.2 only ciphersuites if lower than v1.2 */

		/* Skip TLS v1.2 only ciphersuites if lower than v1.2 */

		if ((c->algorithm_ssl & SSL_TLSV1_2) && 

		if ((c->algorithm_ssl & SSL_TLSV1_2) && 

			(TLS1_get_version(s) < TLS1_2_VERSION))

			(TLS1_get_client_version(s) < TLS1_2_VERSION))

			continue;

			continue;

#ifndef OPENSSL_NO_KRB5

#ifndef OPENSSL_NO_KRB5

		if (((c->algorithm_mkey & SSL_kKRB5) || (c->algorithm_auth & SSL_aKRB5)) &&

		if (((c->algorithm_mkey & SSL_kKRB5) || (c->algorithm_auth & SSL_aKRB5)) &&

ssl/tls1.h

+3 −0
Original line number Original line Diff line number Diff line
@@ -174,6 +174,9 @@ extern "C" { 
#define TLS1_get_version(s) \

#define TLS1_get_version(s) \

		((s->version >> 8) == TLS1_VERSION_MAJOR ? s->version : 0)

		((s->version >> 8) == TLS1_VERSION_MAJOR ? s->version : 0)





#define TLS1_get_client_version(s) \

		((s->client_version >> 8) == TLS1_VERSION_MAJOR ? s->client_version : 0)



#define TLS1_AD_DECRYPTION_FAILED	21

#define TLS1_AD_DECRYPTION_FAILED	21

#define TLS1_AD_RECORD_OVERFLOW		22

#define TLS1_AD_RECORD_OVERFLOW		22

#define TLS1_AD_UNKNOWN_CA		48	/* fatal */

#define TLS1_AD_UNKNOWN_CA		48	/* fatal */