[gnutls-devel] GnuTLS | gnutls_priority_set: do not override version on handshake (!765)

[Development of GNU's TLS library]

Nikos Mavrogiannopoulos commented on a discussion on lib/handshake.c:

> +
> +			if (!old_vers->tls13_sem || (new_max && !new_max->tls13_sem)) {
> +				/* Here we need to renegotiate the version since the callee might
> +				 * have disabled some TLS versions. This will not work for protocols
> +				 * > TLS1.3.
> +				 */
> +				ret = _gnutls_negotiate_version(session, major, minor, 0);
> +				if (ret < 0)
> +					return gnutls_assert_val(ret);
> +
> +				vers = get_version(session);
> +				if (old_vers != vers) {
> +					/* at this point we need to regenerate the random value to
> +					 * avoid the peer detecting this session as a rollback
> +					 * attempt. */
> +					ret = _gnutls_gen_server_random(session, get_version(session)->id);

Done

-- 
Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/merge_requests/765#note_106126844
You're receiving this email because of your account on gitlab.com.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.gnupg.org/pipermail/gnutls-devel/attachments/20181003/788db868/attachment.html>