Don't allow renegotiation for DTLS 1.3

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22362)

diff --git a/apps/include/s_apps.h b/apps/include/s_apps.h
index 33c3b6278c823faf93dcff3487092358bed5b4c7..85eb6dcf364aa95ce7af3f3346c17148bad15ac3 100644 (file)
--- a/apps/include/s_apps.h
+++ b/apps/include/s_apps.h
@@ -16,7 +16,9 @@
 #define PROTOCOL        "tcp"
 
 #define SSL_VERSION_ALLOWS_RENEGOTIATION(s) \
-    (SSL_is_dtls(s) || (SSL_version(s) < TLS1_3_VERSION))
+    ((SSL_is_dtls(s) && (SSL_version(s) > DTLS1_3_VERSION \
+                         || SSL_version(s) == DTLS1_BAD_VER)) \
+     || (!SSL_is_dtls(s) && SSL_version(s) < TLS1_3_VERSION))
 
 typedef int (*do_server_cb)(int s, int stype, int prot, unsigned char *context);
 void get_sock_info_address(int asock, char **hostname, char **service);