From 66c4810ffe98aaf2642be69871c8823dd0cea9e5 Mon Sep 17 00:00:00 2001 From: Paul Bakker Date: Fri, 26 Jul 2013 14:05:32 +0200 Subject: [PATCH] Better handling of ciphersuite version range and forced version in ssl_client2 --- programs/ssl/ssl_client2.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/programs/ssl/ssl_client2.c b/programs/ssl/ssl_client2.c index 50a751854..05dfdc700 100644 --- a/programs/ssl/ssl_client2.c +++ b/programs/ssl/ssl_client2.c @@ -435,13 +435,24 @@ int main( int argc, char *argv[] ) const ssl_ciphersuite_t *ciphersuite_info; ciphersuite_info = ssl_ciphersuite_from_id( opt.force_ciphersuite[0] ); - if( ciphersuite_info->min_minor_ver > opt.max_version || + if( opt.max_version != -1 && + ciphersuite_info->min_minor_ver > opt.max_version ) + { + printf("forced ciphersuite not allowed with this protocol version\n"); + ret = 2; + goto usage; + } + if( opt.min_version != -1 && ciphersuite_info->max_minor_ver < opt.min_version ) { printf("forced ciphersuite not allowed with this protocol version\n"); ret = 2; goto usage; } + if( opt.max_version > ciphersuite_info->max_minor_ver ) + opt.max_version = ciphersuite_info->max_minor_ver; + if( opt.min_version < ciphersuite_info->min_minor_ver ) + opt.min_version = ciphersuite_info->min_minor_ver; } #if defined(POLARSSL_KEY_EXCHANGE_PSK_ENABLED)