generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Support TLS_FALLBACK_SCSV.

Browse Source 
Reviewed-by: Stephen Henson <steve@openssl.org>
This commit is contained in:
Bodo Moeller
2014-10-15 04:03:28 +02:00
parent ffa08b3242
commit cf6da05304
16 changed files with 154 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
ssl/s3_lib.c
View File

@@ -3924,6 +3924,33 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
return (int)sess->tlsext_ecpointformatlist_length;
}
#endif
case SSL_CTRL_CHECK_PROTO_VERSION:
/* For library-internal use; checks that the current protocol
* is the highest enabled version (according to s->ctx->method,
* as version negotiation may have changed s->method). */
if (s->version == s->ctx->method->version)
return 1;
/* Apparently we're using a version-flexible SSL_METHOD
* (not at its highest protocol version). */
if (s->ctx->method->version == SSLv23_method()->version)
{
#if TLS_MAX_VERSION != TLS1_2_VERSION
# error Code needs update for SSLv23_method() support beyond TLS1_2_VERSION.
#endif
if (!(s->options & SSL_OP_NO_TLSv1_2))
return s->version == TLS1_2_VERSION;
if (!(s->options & SSL_OP_NO_TLSv1_1))
return s->version == TLS1_1_VERSION;
if (!(s->options & SSL_OP_NO_TLSv1))
return s->version == TLS1_VERSION;
if (!(s->options & SSL_OP_NO_SSLv3))
return s->version == SSL3_VERSION;
if (!(s->options & SSL_OP_NO_SSLv2))
return s->version == SSL2_VERSION;
}
return 0; /* Unexpected state; fail closed. */
default:
break;
}
@@ -4844,4 +4871,3 @@ long ssl_get_algorithm2(SSL *s)
return SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256;
return alg2;
}