diff options
| author | Bodo Moeller <bodo@openssl.org> | 2014-10-15 04:18:29 +0200 |
|---|---|---|
| committer | Bodo Moeller <bodo@openssl.org> | 2014-10-15 04:18:29 +0200 |
| commit | c6a876473cbff0fd323c8abcaace98ee2d21863d (patch) | |
| tree | e27388ca48f3cc5c4306e0ffee56e592e07fe661 /ssl/s3_lib.c | |
| parent | 5a7fc89394bb11dc8ac578d23d77762d2d58fff2 (diff) | |
Support TLS_FALLBACK_SCSV.
Reviewed-by: Stephen Henson <steve@openssl.org>
Diffstat (limited to 'ssl/s3_lib.c')
| -rw-r--r-- | ssl/s3_lib.c | 24 |
1 files changed, 24 insertions, 0 deletions
diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c index fc723a00a9..fcdbe4779b 100644 --- a/ssl/s3_lib.c +++ b/ssl/s3_lib.c @@ -1986,6 +1986,29 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg) break; #endif /* !OPENSSL_NO_TLSEXT */ + + case SSL_CTRL_CHECK_PROTO_VERSION: + /* For library-internal use; checks that the current protocol + * is the highest enabled version (according to s->ctx->method, + * as version negotiation may have changed s->method). */ + if (s->version == s->ctx->method->version) + return 1; + /* Apparently we're using a version-flexible SSL_METHOD + * (not at its highest protocol version). */ + if (s->ctx->method->version == SSLv23_method()->version) + { +#if TLS_MAX_VERSION != TLS1_VERSION +# error Code needs update for SSLv23_method() support beyond TLS1_VERSION. +#endif + if (!(s->options & SSL_OP_NO_TLSv1)) + return s->version == TLS1_VERSION; + if (!(s->options & SSL_OP_NO_SSLv3)) + return s->version == SSL3_VERSION; + if (!(s->options & SSL_OP_NO_SSLv2)) + return s->version == SSL2_VERSION; + } + return 0; /* Unexpected state; fail closed. */ + default: break; } @@ -2274,6 +2297,7 @@ long ssl3_ctx_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp)(void)) break; #endif + default: return(0); } |