Skip to content

Commit

Permalink
Be more accurate about what we accept as a valid DTLS version
Browse files Browse the repository at this point in the history
We accepted more version numbers as valid DTLS then we really should do.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from #20830)
  • Loading branch information
mattcaswell committed May 5, 2023
1 parent e89f9ef commit 861cd89
Showing 1 changed file with 4 additions and 2 deletions.
6 changes: 4 additions & 2 deletions ssl/statem/statem_lib.c
Expand Up @@ -2049,8 +2049,10 @@ int ssl_set_version_bound(int method_version, int version, int *bound)

valid_tls = version >= SSL3_VERSION && version <= TLS_MAX_VERSION_INTERNAL;
valid_dtls =
DTLS_VERSION_LE(version, DTLS_MAX_VERSION_INTERNAL) &&
DTLS_VERSION_GE(version, DTLS1_BAD_VER);
/* We support client side pre-standardisation version of DTLS */
(version == DTLS1_BAD_VER)
|| (DTLS_VERSION_LE(version, DTLS_MAX_VERSION_INTERNAL)
&& DTLS_VERSION_GE(version, DTLS1_VERSION));

if (!valid_tls && !valid_dtls)
return 0;
Expand Down

0 comments on commit 861cd89

Please sign in to comment.