From: Matt Caswell <matt@openssl.org>
Date: Mon, 23 Apr 2018 16:14:47 +0000 (+0100)
Subject: In a reneg use the same client_version we used last time
X-Git-Tag: OpenSSL_1_1_1-pre6~36
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=447cc0ad732858f3ab80b2dc52f15fd045b25363;p=oweals%2Fopenssl.git

In a reneg use the same client_version we used last time

In 1.0.2 and below we always send the same client_version in a reneg
ClientHello that we sent the first time around, regardless of what
version eventually gets negotiated. According to a comment in
statem_clnt.c this is a workaround for some buggy servers that choked if
we changed the version used in the RSA encrypted premaster secret.

In 1.1.0+ this behaviour no longer occurs. This restores the original
behaviour.

Fixes #1651

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6059)
---

diff --git a/ssl/statem/statem_lib.c b/ssl/statem/statem_lib.c
index 269ba85997..49b44433f9 100644
--- a/ssl/statem/statem_lib.c
+++ b/ssl/statem/statem_lib.c
@@ -2004,6 +2004,13 @@ int ssl_set_client_hello_version(SSL *s)
 {
     int ver_min, ver_max, ret;
 
+    /*
+     * In a renegotiation we always send the same client_version that we sent
+     * last time, regardless of which version we eventually negotiated.
+     */
+    if (!SSL_IS_FIRST_HANDSHAKE(s))
+        return 0;
+
     ret = ssl_get_min_max_version(s, &ver_min, &ver_max);
 
     if (ret != 0)