From 5b55b79021c7e30c8dc7a37e386fb79ed95db212 Mon Sep 17 00:00:00 2001 From: Paul Bakker Date: Fri, 19 Jul 2013 13:43:43 +0200 Subject: [PATCH] Better handling of ciphersuite version range and forced version in ssl_server2 --- programs/ssl/ssl_server2.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/programs/ssl/ssl_server2.c b/programs/ssl/ssl_server2.c index d5ebb812b..c12e2d031 100644 --- a/programs/ssl/ssl_server2.c +++ b/programs/ssl/ssl_server2.c @@ -405,13 +405,24 @@ int main( int argc, char *argv[] ) const ssl_ciphersuite_t *ciphersuite_info; ciphersuite_info = ssl_ciphersuite_from_id( opt.force_ciphersuite[0] ); - if( ciphersuite_info->min_minor_ver > opt.max_version || + if( opt.max_version != -1 && + ciphersuite_info->min_minor_ver > opt.max_version ) + { + printf("forced ciphersuite not allowed with this protocol version\n"); + ret = 2; + goto usage; + } + if( opt.min_version != -1 && ciphersuite_info->max_minor_ver < opt.min_version ) { printf("forced ciphersuite not allowed with this protocol version\n"); ret = 2; goto usage; } + if( opt.max_version > ciphersuite_info->max_minor_ver ) + opt.max_version = ciphersuite_info->max_minor_ver; + if( opt.min_version < ciphersuite_info->min_minor_ver ) + opt.min_version = ciphersuite_info->min_minor_ver; } #if defined(POLARSSL_KEY_EXCHANGE_PSK_ENABLED)