commit 03bac448db441d66612e2a2ed2c5e2f1ec2b04b8
author Andrzej Kurek <andrzej.kurek@arm.com> Wed Apr 25 05:06:07 2018 -0400
committer Andrzej Kurek <andrzej.kurek@arm.com> Wed Apr 25 05:06:07 2018 -0400
tree cd05fae00fe0f718b3edb03e850b5b7798a54c77
parent 1d3b508b825f0f4fc2e27694fde6aa1c56184f34

Change accepted ciphersuite versions when parsing server hello

Accept only ciphersuites for version chosen by the server

library/ssl_cli.c

diff --git a/library/ssl_cli.c b/library/ssl_cli.c
index efcf48b..f4dc02a 100644
--- a/library/ssl_cli.c
+++ b/library/ssl_cli.c
@@ -722,17 +722,21 @@
  *
  * \param suite_info    cipher suite to validate
  * \param ssl           SSL context
+ * \param min_minor_ver Minimal minor version to accept a cipher suite
+ * \param max_minor_ver Maximal minor version to accept a cipher suite
  *
  * \return          0 if valid, else 1
  */
 static int ssl_validate_ciphersuite( const mbedtls_ssl_ciphersuite_t * suite_info,
-                                     const mbedtls_ssl_context * ssl )
+                                     const mbedtls_ssl_context * ssl,
+                                     int min_minor_ver, int max_minor_ver )
 {
+    (void) ssl;
     if( suite_info == NULL )
         return( 1 );
 
-    if( suite_info->min_minor_ver > ssl->conf->max_minor_ver ||
-            suite_info->max_minor_ver < ssl->conf->min_minor_ver )
+    if( suite_info->min_minor_ver > max_minor_ver ||
+            suite_info->max_minor_ver < min_minor_ver )
         return( 1 );
 
 #if defined(MBEDTLS_SSL_PROTO_DTLS)
@@ -908,7 +912,9 @@
     {
         ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( ciphersuites[i] );
 
-        if( ssl_validate_ciphersuite( ciphersuite_info, ssl ) != 0 )
+        if( ssl_validate_ciphersuite( ciphersuite_info, ssl,
+                                      ssl->conf->min_minor_ver,
+                                      ssl->conf->max_minor_ver ) != 0 )
             continue;
 
         MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, add ciphersuite: %04x",
@@ -1707,7 +1713,8 @@
     MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, chosen ciphersuite: %04x", i ) );
     MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, compress alg.: %d", buf[37 + n] ) );
 
-    /* Perform cipher suite validation in same way as in ssl_write_client_hello.
+    /*
+     * Perform cipher suite validation in same way as in ssl_write_client_hello.
      */
     i = 0;
     while( 1 )
@@ -1728,7 +1735,7 @@
     }
 
     suite_info = mbedtls_ssl_ciphersuite_from_id( ssl->session_negotiate->ciphersuite );
-    if( ssl_validate_ciphersuite( suite_info, ssl ) != 0 )
+    if( ssl_validate_ciphersuite( suite_info, ssl, ssl->minor_ver, ssl->minor_ver ) != 0 )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,