1berry/MariaDB-server
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

MDEV-12190 YASSL isn't able to negotiate TLS version correctly

Browse Source 
Backport from 10.2
This commit is contained in:
Vladislav Vaintroub 2018-03-14 14:35:27 +00:00
parent 926edd48e1
commit 0943b33de3
1 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
extra/yassl/src/handshake.cpp
View File

@ -787,6 +787,16 @@ int DoProcessReply(SSL& ssl)
needHdr = true;
else {
buffer >> hdr;
/*
According to RFC 4346 (see "7.4.1.3. Server Hello"), the Server Hello
packet needs to specify the highest supported TLS version, but not
higher than what client requests. YaSSL highest supported version is
TLSv1.1 (=3.2) - if the client requests a higher version, downgrade it
here to 3.2.
See also Appendix E of RFC 5246 (TLS 1.2)
*/
if (hdr.version_.major_ == 3 && hdr.version_.minor_ > 2)
hdr.version_.minor_ = 2;
ssl.verifyState(hdr);
}