diff options
| author | Nikos Mavrogiannopoulos <nmav@redhat.com> | 2015-12-14 14:34:04 +0100 |
|---|---|---|
| committer | Nikos Mavrogiannopoulos <nmav@redhat.com> | 2015-12-14 15:11:46 +0100 |
| commit | f5174e5c83298d19ab2348d58a1b462ca95f4a9a (patch) | |
| tree | 7128ae08cec65721d1e32e191efc5dd6dda74d1c /lib/sslv2_compat.c | |
| parent | da7edadb6ff6e440b38c7343cb4e447b7b22db9e (diff) | |
| download | gnutls-f5174e5c83298d19ab2348d58a1b462ca95f4a9a.tar.gz | |
handshake: when receiving a TLS version which is too low fail
That is, don't treat all unsupported version as being to high. Treat
versions which are not known and lower than the highest as a protocol
error.
Resolves #42
Diffstat (limited to 'lib/sslv2_compat.c')
| -rw-r--r-- | lib/sslv2_compat.c | 12 |
1 files changed, 7 insertions, 5 deletions
diff --git a/lib/sslv2_compat.c b/lib/sslv2_compat.c index 8a717d3835..f742a098d8 100644 --- a/lib/sslv2_compat.c +++ b/lib/sslv2_compat.c @@ -94,7 +94,7 @@ _gnutls_read_client_hello_v2(gnutls_session_t session, uint8_t * data, int ret = 0, sret = 0; uint16_t sizeOfSuites; gnutls_protocol_t adv_version; - uint8_t rnd[GNUTLS_RANDOM_SIZE]; + uint8_t rnd[GNUTLS_RANDOM_SIZE], major, minor; int len = datalen; uint16_t challenge; uint8_t session_id[GNUTLS_MAX_SESSION_ID_SIZE]; @@ -105,11 +105,13 @@ _gnutls_read_client_hello_v2(gnutls_session_t session, uint8_t * data, ("HSK[%p]: SSL 2.0 Hello: Client's version: %d.%d\n", session, data[pos], data[pos + 1]); - set_adv_version(session, data[pos], data[pos + 1]); + major = data[pos]; + minor = data[pos + 1]; + set_adv_version(session, major, minor); - adv_version = _gnutls_version_get(data[pos], data[pos + 1]); + adv_version = _gnutls_version_get(major, minor); - ret = _gnutls_negotiate_version(session, adv_version); + ret = _gnutls_negotiate_version(session, adv_version, major, minor); if (ret < 0) { gnutls_assert(); return ret; @@ -144,7 +146,7 @@ _gnutls_read_client_hello_v2(gnutls_session_t session, uint8_t * data, /* call the user hello callback */ - ret = _gnutls_user_hello_func(session, adv_version); + ret = _gnutls_user_hello_func(session, adv_version, major, minor); if (ret < 0) { if (ret == GNUTLS_E_AGAIN || ret == GNUTLS_E_INTERRUPTED) { sret = GNUTLS_E_INT_RET_0; |