diff options
author | tb <> | 2022-06-30 11:17:50 +0000 |
---|---|---|
committer | tb <> | 2022-06-30 11:17:50 +0000 |
commit | 5f574489be242a7d86373038f340aaf574a0b228 (patch) | |
tree | fb1aefe52767d19838deec117e17af2cbf6cd936 /src/lib/libssl/ssl_clnt.c | |
parent | 727d040aad78fde5a0f1d575255736d37d0c721c (diff) | |
download | openbsd-5f574489be242a7d86373038f340aaf574a0b228.tar.gz openbsd-5f574489be242a7d86373038f340aaf574a0b228.tar.bz2 openbsd-5f574489be242a7d86373038f340aaf574a0b228.zip |
Add checks to ensure we do not initiate or negotiate handshakes with
versions below the minimum required by the security level.
input & ok jsing
Diffstat (limited to 'src/lib/libssl/ssl_clnt.c')
-rw-r--r-- | src/lib/libssl/ssl_clnt.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/src/lib/libssl/ssl_clnt.c b/src/lib/libssl/ssl_clnt.c index d49d8ef056..604b55277c 100644 --- a/src/lib/libssl/ssl_clnt.c +++ b/src/lib/libssl/ssl_clnt.c | |||
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: ssl_clnt.c,v 1.148 2022/06/29 08:34:04 tb Exp $ */ | 1 | /* $OpenBSD: ssl_clnt.c,v 1.149 2022/06/30 11:17:49 tb Exp $ */ |
2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) |
3 | * All rights reserved. | 3 | * All rights reserved. |
4 | * | 4 | * |
@@ -221,6 +221,13 @@ ssl3_connect(SSL *s) | |||
221 | goto end; | 221 | goto end; |
222 | } | 222 | } |
223 | 223 | ||
224 | if (!ssl_security_version(s, | ||
225 | s->s3->hs.our_min_tls_version)) { | ||
226 | SSLerror(s, SSL_R_VERSION_TOO_LOW); | ||
227 | ret = -1; | ||
228 | goto end; | ||
229 | } | ||
230 | |||
224 | if (!ssl3_setup_init_buffer(s)) { | 231 | if (!ssl3_setup_init_buffer(s)) { |
225 | ret = -1; | 232 | ret = -1; |
226 | goto end; | 233 | goto end; |