summaryrefslogtreecommitdiff
path: root/src/lib/libssl/ssl_clnt.c
diff options
context:
space:
mode:
authortb <>2022-06-30 11:17:50 +0000
committertb <>2022-06-30 11:17:50 +0000
commit5f574489be242a7d86373038f340aaf574a0b228 (patch)
treefb1aefe52767d19838deec117e17af2cbf6cd936 /src/lib/libssl/ssl_clnt.c
parent727d040aad78fde5a0f1d575255736d37d0c721c (diff)
downloadopenbsd-5f574489be242a7d86373038f340aaf574a0b228.tar.gz
openbsd-5f574489be242a7d86373038f340aaf574a0b228.tar.bz2
openbsd-5f574489be242a7d86373038f340aaf574a0b228.zip
Add checks to ensure we do not initiate or negotiate handshakes with
versions below the minimum required by the security level. input & ok jsing
Diffstat (limited to 'src/lib/libssl/ssl_clnt.c')
-rw-r--r--src/lib/libssl/ssl_clnt.c9
1 files changed, 8 insertions, 1 deletions
diff --git a/src/lib/libssl/ssl_clnt.c b/src/lib/libssl/ssl_clnt.c
index d49d8ef056..604b55277c 100644
--- a/src/lib/libssl/ssl_clnt.c
+++ b/src/lib/libssl/ssl_clnt.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ssl_clnt.c,v 1.148 2022/06/29 08:34:04 tb Exp $ */ 1/* $OpenBSD: ssl_clnt.c,v 1.149 2022/06/30 11:17:49 tb Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved. 3 * All rights reserved.
4 * 4 *
@@ -221,6 +221,13 @@ ssl3_connect(SSL *s)
221 goto end; 221 goto end;
222 } 222 }
223 223
224 if (!ssl_security_version(s,
225 s->s3->hs.our_min_tls_version)) {
226 SSLerror(s, SSL_R_VERSION_TOO_LOW);
227 ret = -1;
228 goto end;
229 }
230
224 if (!ssl3_setup_init_buffer(s)) { 231 if (!ssl3_setup_init_buffer(s)) {
225 ret = -1; 232 ret = -1;
226 goto end; 233 goto end;