summaryrefslogtreecommitdiff
path: root/src/lib/libssl/ssl_ciphers.c
diff options
context:
space:
mode:
Diffstat (limited to 'src/lib/libssl/ssl_ciphers.c')
-rw-r--r--src/lib/libssl/ssl_ciphers.c12
1 files changed, 5 insertions, 7 deletions
diff --git a/src/lib/libssl/ssl_ciphers.c b/src/lib/libssl/ssl_ciphers.c
index 374cb6684e..3abed60b5b 100644
--- a/src/lib/libssl/ssl_ciphers.c
+++ b/src/lib/libssl/ssl_ciphers.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ssl_ciphers.c,v 1.2 2019/01/21 14:12:13 tb Exp $ */ 1/* $OpenBSD: ssl_ciphers.c,v 1.3 2019/05/15 09:13:16 bcook Exp $ */
2/* 2/*
3 * Copyright (c) 2015-2017 Doug Hogan <doug@openbsd.org> 3 * Copyright (c) 2015-2017 Doug Hogan <doug@openbsd.org>
4 * Copyright (c) 2015-2018 Joel Sing <jsing@openbsd.org> 4 * Copyright (c) 2015-2018 Joel Sing <jsing@openbsd.org>
@@ -95,8 +95,7 @@ ssl_bytes_to_cipher_list(SSL *s, CBS *cbs)
95 uint16_t cipher_value, max_version; 95 uint16_t cipher_value, max_version;
96 unsigned long cipher_id; 96 unsigned long cipher_id;
97 97
98 if (s->s3 != NULL) 98 S3I(s)->send_connection_binding = 0;
99 S3I(s)->send_connection_binding = 0;
100 99
101 if ((ciphers = sk_SSL_CIPHER_new_null()) == NULL) { 100 if ((ciphers = sk_SSL_CIPHER_new_null()) == NULL) {
102 SSLerror(s, ERR_R_MALLOC_FAILURE); 101 SSLerror(s, ERR_R_MALLOC_FAILURE);
@@ -111,7 +110,7 @@ ssl_bytes_to_cipher_list(SSL *s, CBS *cbs)
111 110
112 cipher_id = SSL3_CK_ID | cipher_value; 111 cipher_id = SSL3_CK_ID | cipher_value;
113 112
114 if (s->s3 != NULL && cipher_id == SSL3_CK_SCSV) { 113 if (cipher_id == SSL3_CK_SCSV) {
115 /* 114 /*
116 * TLS_EMPTY_RENEGOTIATION_INFO_SCSV is fatal if 115 * TLS_EMPTY_RENEGOTIATION_INFO_SCSV is fatal if
117 * renegotiating. 116 * renegotiating.
@@ -137,9 +136,8 @@ ssl_bytes_to_cipher_list(SSL *s, CBS *cbs)
137 max_version = ssl_max_server_version(s); 136 max_version = ssl_max_server_version(s);
138 if (max_version == 0 || s->version < max_version) { 137 if (max_version == 0 || s->version < max_version) {
139 SSLerror(s, SSL_R_INAPPROPRIATE_FALLBACK); 138 SSLerror(s, SSL_R_INAPPROPRIATE_FALLBACK);
140 if (s->s3 != NULL) 139 ssl3_send_alert(s, SSL3_AL_FATAL,
141 ssl3_send_alert(s, SSL3_AL_FATAL, 140 SSL_AD_INAPPROPRIATE_FALLBACK);
142 SSL_AD_INAPPROPRIATE_FALLBACK);
143 goto err; 141 goto err;
144 } 142 }
145 continue; 143 continue;