diff options
| author | Nikos Mavrogiannopoulos <nmav@redhat.com> | 2017-07-18 09:23:53 +0200 |
|---|---|---|
| committer | Nikos Mavrogiannopoulos <nmav@redhat.com> | 2017-09-11 16:57:05 +0200 |
| commit | d519a628f4aa32fc64afc7e18a0d4b1130a8df6f (patch) | |
| tree | 7f20641ad2414884f5b21f270d3298c3f0d3bdb0 | |
| parent | e82d150ee1ba5c967dc749ce8a927570b276917d (diff) | |
| download | gnutls-d519a628f4aa32fc64afc7e18a0d4b1130a8df6f.tar.gz | |
handshake: always accept TLS 1.2 in client hello if we have later protocols enabled
That is because after TLS 1.3 there is no negotiation of the version using
the Client Hello field, but with an extension.
Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
| -rw-r--r-- | lib/handshake.c | 13 |
1 files changed, 12 insertions, 1 deletions
diff --git a/lib/handshake.c b/lib/handshake.c index 3a9480c24c..8ed442b897 100644 --- a/lib/handshake.c +++ b/lib/handshake.c @@ -365,8 +365,19 @@ _gnutls_negotiate_legacy_version(gnutls_session_t session, { const version_entry_st *vers; - /* if we do not support that version */ + /* if we do not support that version, unless that version is TLS 1.2; + * TLS 1.2 is handled separately because it is always advertized under TLS 1.3 or later */ if (adv_version == GNUTLS_VERSION_UNKNOWN || _gnutls_version_is_supported(session, adv_version) == 0) { + + if (adv_version == GNUTLS_TLS1_2) { + vers = _gnutls_version_max(session); + if (vers->id >= GNUTLS_TLS1_2) { + if (_gnutls_set_current_version(session, adv_version) < 0) + return gnutls_assert_val(GNUTLS_E_UNSUPPORTED_VERSION_PACKET); + return adv_version; + } + } + /* if we get an unknown/unsupported version, then fail if the version we * got is too low to be supported */ if (!_gnutls_version_is_too_high(session, major, minor)) |