From 032924c4b4104654ff8659b4701e4ab25872a12e Mon Sep 17 00:00:00 2001 From: David Woodhouse Date: Mon, 25 Jul 2016 18:03:27 +0100 Subject: Make DTLS1_BAD_VER work with DTLS_client_method() DTLSv1_client_method() is deprecated, but it was the only way to obtain DTLS1_BAD_VER support. The SSL_OP_CISCO_ANYCONNECT hack doesn't work with DTLS_client_method(), and it's relatively non-trivial to make it work without expanding the hack into lots of places. So deprecate SSL_OP_CISCO_ANYCONNECT with DTLSv1_client_method(), and make it work with SSL_CTX_set_{min,max}_proto_version(DTLS1_BAD_VER) instead. Reviewed-by: Rich Salz Reviewed-by: Matt Caswell --- ssl/d1_lib.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) (limited to 'ssl/d1_lib.c') diff --git a/ssl/d1_lib.c b/ssl/d1_lib.c index 0a985551b8..08a503786f 100644 --- a/ssl/d1_lib.c +++ b/ssl/d1_lib.c @@ -179,10 +179,13 @@ void dtls1_clear(SSL *s) } ssl3_clear(s); - if (s->options & SSL_OP_CISCO_ANYCONNECT) - s->client_version = s->version = DTLS1_BAD_VER; - else if (s->method->version == DTLS_ANY_VERSION) + + if (s->method->version == DTLS_ANY_VERSION) s->version = DTLS_MAX_VERSION; +#ifndef OPENSSL_NO_DTLS1_METHOD + else if (s->options & SSL_OP_CISCO_ANYCONNECT) + s->client_version = s->version = DTLS1_BAD_VER; +#endif else s->version = s->method->version; } -- cgit v1.2.3