From ed4899dd91a3901b30f874f7fde9f7a1d1a041a4 Mon Sep 17 00:00:00 2001 From: Sean Parkinson Date: Mon, 11 May 2020 13:18:50 +1000 Subject: [PATCH] Only check downgrade when TLS 1.2 and no flag set The flag, SSL_OP_NO_TLSv1_2, indicates not to negotiate TLS v1.2. --- src/internal.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/src/internal.c b/src/internal.c index 8c6f62a63..2e8715d2f 100644 --- a/src/internal.c +++ b/src/internal.c @@ -20238,7 +20238,11 @@ exit_dpk: else #endif if (ssl->ctx->method->version.major == SSLv3_MAJOR && - ssl->ctx->method->version.minor == TLSv1_2_MINOR) { + ssl->ctx->method->version.minor == TLSv1_2_MINOR +#ifdef OPENSSL_EXTRA + && (wolfSSL_get_options(ssl) & SSL_OP_NO_TLSv1_2) == 0 +#endif + ) { /* TLS v1.2 capable client not allowed to downgrade when * connecting to TLS v1.2 capable server. */ @@ -24230,6 +24234,9 @@ static int DoSessionTicket(WOLFSSL* ssl, const byte* input, word32* inOutIdx, #endif if (ssl->ctx->method->version.major == SSLv3_MAJOR && ssl->ctx->method->version.minor == TLSv1_2_MINOR && +#ifdef OPENSSL_EXTRA + (wolfSSL_get_options(ssl) & SSL_OP_NO_TLSv1_2) == 0 && +#endif !IsAtLeastTLSv1_2(ssl)) { /* TLS v1.2 capable server downgraded. */ XMEMCPY(output + idx + RAN_LEN - (TLS13_DOWNGRADE_SZ + 1),