From 0943b33de3daa0fcbf58803be8e991941de63218 Mon Sep 17 00:00:00 2001 From: Vladislav Vaintroub Date: Wed, 14 Mar 2018 14:35:27 +0000 Subject: [PATCH] MDEV-12190 YASSL isn't able to negotiate TLS version correctly Backport from 10.2 --- extra/yassl/src/handshake.cpp | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/extra/yassl/src/handshake.cpp b/extra/yassl/src/handshake.cpp index aa2de39333c0d..bb8e37915528c 100644 --- a/extra/yassl/src/handshake.cpp +++ b/extra/yassl/src/handshake.cpp @@ -787,6 +787,16 @@ int DoProcessReply(SSL& ssl) needHdr = true; else { buffer >> hdr; + /* + According to RFC 4346 (see "7.4.1.3. Server Hello"), the Server Hello + packet needs to specify the highest supported TLS version, but not + higher than what client requests. YaSSL highest supported version is + TLSv1.1 (=3.2) - if the client requests a higher version, downgrade it + here to 3.2. + See also Appendix E of RFC 5246 (TLS 1.2) + */ + if (hdr.version_.major_ == 3 && hdr.version_.minor_ > 2) + hdr.version_.minor_ = 2; ssl.verifyState(hdr); }