wolfSSL/wolfssl
1
0
Fork 1
mirror of https://github.com/wolfSSL/wolfssl.git synced 2026-07-09 11:00:51 +02:00
Code Issues Packages Projects Releases Wiki Activity

Change suggested by SparkiDev

Browse Source
This commit is contained in:
Anthony Hu
2025-07-10 10:40:12 -04:00
parent 57e2ae5a21
commit 4bd2835cf1
1 changed files with 16 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/tls13.c
+16 -16
View File
@@ -6817,22 +6817,6 @@ int DoTls13ClientHello(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
ERROR_OUT(VERSION_ERROR, exit_dch);
}
#ifndef WOLFSSL_ALLOW_BAD_TLS_LEGACY_VERSION
/* Check for TLS 1.3 version (0x0304) in legacy version field. RFC 8446
* Section 4.2.1 allows this action:
*
* "Servers MAY abort the handshake upon receiving a ClientHello with
* legacy_version 0x0304 or later."
*
* Note that if WOLFSSL_ALLOW_BAD_TLS_LEGACY_VERSION is defined then the
* semantics of RFC 5246 Appendix E will be followed. A ServerHello with
* version 1.2 will be sent. */
if (args->pv.major == SSLv3_MAJOR && args->pv.minor >= TLSv1_3_MINOR) {
WOLFSSL_MSG("Legacy version field is TLS 1.3 or later. Aborting.");
ERROR_OUT(VERSION_ERROR, exit_dch);
}
#endif /* WOLFSSL_ALLOW_BAD_TLS_LEGACY_VERSION */
#ifdef WOLFSSL_DTLS13
if (ssl->options.dtls &&
args->pv.major == DTLS_MAJOR && args->pv.minor > DTLSv1_2_MINOR) {
@@ -6842,6 +6826,22 @@ int DoTls13ClientHello(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
#endif /* WOLFSSL_DTLS13 */
if (!ssl->options.dtls) {
#ifndef WOLFSSL_ALLOW_BAD_TLS_LEGACY_VERSION
/* Check for TLS 1.3 version (0x0304) in legacy version field. RFC 8446
* Section 4.2.1 allows this action:
*
* "Servers MAY abort the handshake upon receiving a ClientHello with
* legacy_version 0x0304 or later."
*
* Note that if WOLFSSL_ALLOW_BAD_TLS_LEGACY_VERSION is defined then the
* semantics of RFC 5246 Appendix E will be followed. A ServerHello with
* version 1.2 will be sent. */
if (args->pv.major == SSLv3_MAJOR && args->pv.minor >= TLSv1_3_MINOR) {
WOLFSSL_MSG("Legacy version field is TLS 1.3 or later. Aborting.");
ERROR_OUT(VERSION_ERROR, exit_dch);
}
#endif /* WOLFSSL_ALLOW_BAD_TLS_LEGACY_VERSION */
/* Legacy protocol version cannot negotiate TLS 1.3 or higher. */
if (args->pv.major > SSLv3_MAJOR || (args->pv.major == SSLv3_MAJOR &&
args->pv.minor >= TLSv1_3_MINOR)) {