diff options
author | tb <> | 2022-06-30 11:17:50 +0000 |
---|---|---|
committer | tb <> | 2022-06-30 11:17:50 +0000 |
commit | 5f574489be242a7d86373038f340aaf574a0b228 (patch) | |
tree | fb1aefe52767d19838deec117e17af2cbf6cd936 /src/lib/libssl/ssl_srvr.c | |
parent | 727d040aad78fde5a0f1d575255736d37d0c721c (diff) | |
download | openbsd-5f574489be242a7d86373038f340aaf574a0b228.tar.gz openbsd-5f574489be242a7d86373038f340aaf574a0b228.tar.bz2 openbsd-5f574489be242a7d86373038f340aaf574a0b228.zip |
Add checks to ensure we do not initiate or negotiate handshakes with
versions below the minimum required by the security level.
input & ok jsing
Diffstat (limited to 'src/lib/libssl/ssl_srvr.c')
-rw-r--r-- | src/lib/libssl/ssl_srvr.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/src/lib/libssl/ssl_srvr.c b/src/lib/libssl/ssl_srvr.c index e37f9cfdb7..8f110831e4 100644 --- a/src/lib/libssl/ssl_srvr.c +++ b/src/lib/libssl/ssl_srvr.c | |||
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: ssl_srvr.c,v 1.145 2022/06/29 08:27:51 tb Exp $ */ | 1 | /* $OpenBSD: ssl_srvr.c,v 1.146 2022/06/30 11:17:50 tb Exp $ */ |
2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) |
3 | * All rights reserved. | 3 | * All rights reserved. |
4 | * | 4 | * |
@@ -223,6 +223,13 @@ ssl3_accept(SSL *s) | |||
223 | goto end; | 223 | goto end; |
224 | } | 224 | } |
225 | 225 | ||
226 | if (!ssl_security_version(s, | ||
227 | s->s3->hs.our_min_tls_version)) { | ||
228 | SSLerror(s, SSL_R_VERSION_TOO_LOW); | ||
229 | ret = -1; | ||
230 | goto end; | ||
231 | } | ||
232 | |||
226 | if (!ssl3_setup_init_buffer(s)) { | 233 | if (!ssl3_setup_init_buffer(s)) { |
227 | ret = -1; | 234 | ret = -1; |
228 | goto end; | 235 | goto end; |