Skip to content

Commit

Permalink
When selecting a method ensure we use the correct client/server version
Browse files Browse the repository at this point in the history
Using the client one when the server once should be used could cause a
later call to SSL_set_accept_state() to unexpectedly fail.

Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from #23256)
  • Loading branch information
mattcaswell committed Jan 31, 2024
1 parent 5fb0655 commit a867140
Showing 1 changed file with 6 additions and 3 deletions.
9 changes: 6 additions & 3 deletions ssl/statem/statem_lib.c
Original file line number Diff line number Diff line change
Expand Up @@ -1977,14 +1977,17 @@ int ssl_version_supported(const SSL_CONNECTION *s, int version,
for (vent = table;
vent->version != 0 && ssl_version_cmp(s, version, vent->version) <= 0;
++vent) {
if (vent->cmeth != NULL
const SSL_METHOD *(*thismeth)(void) = s->server ? vent->smeth
: vent->cmeth;

if (thismeth != NULL
&& ssl_version_cmp(s, version, vent->version) == 0
&& ssl_method_error(s, vent->cmeth()) == 0
&& ssl_method_error(s, thismeth()) == 0
&& (!s->server
|| version != TLS1_3_VERSION
|| is_tls13_capable(s))) {
if (meth != NULL)
*meth = vent->cmeth();
*meth = thismeth();
return 1;
}
}
Expand Down

0 comments on commit a867140

Please sign in to comment.