Add record version checks.

When legacy version is below TLSv1.2 ensure that the record version is
SSL3/TLS, however when the legacy version is set to TLSv1.2 require this
specifically.

ok beck@ tb@

1 files changed, 13 insertions, 12 deletions

diff --git a/src/lib/libssl/tls13_internal.h b/src/lib/libssl/tls13_internal.h
index d597ef5a96..d35610e179 100644
--- a/src/lib/libssl/tls13_internal.h
+++ b/src/lib/libssl/tls13_internal.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls13_internal.h,v 1.77 2020/05/11 17:46:46 jsing Exp $ */
+/* $OpenBSD: tls13_internal.h,v 1.78 2020/05/11 18:03:51 jsing Exp $ */
 /*
  * Copyright (c) 2018 Bob Beck <beck@openbsd.org>
  * Copyright (c) 2018 Theo Buehler <tb@openbsd.org>
@@ -27,17 +27,18 @@
 
 __BEGIN_HIDDEN_DECLS
 
-#define TLS13_HS_CLIENT         1
-#define TLS13_HS_SERVER         2
-
-#define TLS13_IO_SUCCESS         1
-#define TLS13_IO_EOF             0
-#define TLS13_IO_FAILURE        -1
-#define TLS13_IO_ALERT          -2
-#define TLS13_IO_WANT_POLLIN    -3
-#define TLS13_IO_WANT_POLLOUT   -4
-#define TLS13_IO_WANT_RETRY     -5 /* Retry the previous call immediately. */
-#define TLS13_IO_USE_LEGACY     -6
+#define TLS13_HS_CLIENT                 1
+#define TLS13_HS_SERVER                 2
+
+#define TLS13_IO_SUCCESS                 1
+#define TLS13_IO_EOF                     0
+#define TLS13_IO_FAILURE                -1
+#define TLS13_IO_ALERT                  -2
+#define TLS13_IO_WANT_POLLIN            -3
+#define TLS13_IO_WANT_POLLOUT           -4
+#define TLS13_IO_WANT_RETRY             -5 /* Retry the previous call immediately. */
+#define TLS13_IO_USE_LEGACY             -6
+#define TLS13_IO_RECORD_VERSION         -7
 
 #define TLS13_ERR_VERIFY_FAILED         16
 #define TLS13_ERR_HRR_FAILED            17