tls-server: Determine supported/configured suites and versions early

If we don't do this, we might negotiate a TLS version for which we don't
have any suites configured, so that the cipher suite negotiation
subsequently fails.

diff --git a/src/libtls/tls_crypto.c b/src/libtls/tls_crypto.c
index 06fd9229f29631a71e75fd63ab8037552f9078c5..f24713de13f92402221f671c244e397c82d04fd3 100644 (file)
--- a/src/libtls/tls_crypto.c
+++ b/src/libtls/tls_crypto.c
@@ -1228,7 +1228,10 @@ METHOD(tls_crypto_t, get_cipher_suites, int,
        {
                build_cipher_suite_list(this);
        }
-       *suites = this->suites;
+       if (suites)
+       {
+               *suites = this->suites;
+       }
        return this->suite_count;
 }
 
@@ -1376,11 +1379,6 @@ METHOD(tls_crypto_t, select_cipher_suite, tls_cipher_suite_t,
        suite_algs_t *algs;
        int i, j;
 
-       if (!this->suites)
-       {
-               build_cipher_suite_list(this);
-       }
-
        for (i = 0; i < this->suite_count; i++)
        {
                for (j = 0; j < count; j++)

diff --git a/src/libtls/tls_crypto.h b/src/libtls/tls_crypto.h
index b5dd4f930505d70984d0c0ce3e143aaa66d7f427..958b7db298abdd0821af7706ab5a5d41d1ae12a5 100644 (file)
--- a/src/libtls/tls_crypto.h
+++ b/src/libtls/tls_crypto.h
@@ -436,7 +436,7 @@ struct tls_crypto_t {
        /**
         * Get a list of supported TLS cipher suites.
         *
-        * @param suites                list of suites, points to internal data
+        * @param suites                optional list of suites, points to internal data
         * @return                              number of suites returned
         */
        int (*get_cipher_suites)(tls_crypto_t *this, tls_cipher_suite_t **suites);

diff --git a/src/libtls/tls_server.c b/src/libtls/tls_server.c
index 8675dc20ec0c0ceb9703ef0fb61658bb1a026ddd..990365ff1d5646480cd8cbf8555d11d2831f295c 100644 (file)
--- a/src/libtls/tls_server.c
+++ b/src/libtls/tls_server.c
@@ -235,6 +235,10 @@ static status_t process_client_hello(private_tls_server_t *this,
                return NEED_MORE;
        }
 
+       /* before we do anything version-related, determine our supported suites
+        * as that might change the min./max. versions */
+       this->crypto->get_cipher_suites(this->crypto, NULL);
+
        if (ext.len)
        {
                extensions = bio_reader_create(ext);