gnutls_handshake when sending client hello during a

rehandshake, will not offer a version number larger than the current.
Reported by Tristan Hill <stan@saticed.me.uk>.

diff --git a/NEWS b/NEWS
index f40dd013ad9574718663e5211e5a84fd72a2548d..a78281d1198628221ae41d58a29e0a6cd4f300cd 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -5,6 +5,13 @@ See the end for copying conditions.
 
 * Version 2.7.5 (unreleased)
 
+** libgnutls: result_size in gnutls_hex_encode now holds
+the size of the result. Report by John Brooks <special@dereferenced.net>.
+
+** libgnutls: gnutls_handshake when sending client hello during a
+rehandshake, will not offer a version number larger than the current.
+Reported by Tristan Hill <stan@saticed.me.uk>.
+
 ** libgnutls: Permit V1 Certificate Authorities properly.
 Before they were mistakenly rejected even though
 GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT and/or

diff --git a/lib/gnutls_handshake.c b/lib/gnutls_handshake.c
index 58880ca610b82ecaa8703833ab037f9e3808ed86..8086af1e768ce7e5851179c95460e92a0d1472eb 100644 (file)
--- a/lib/gnutls_handshake.c
+++ b/lib/gnutls_handshake.c
@@ -1705,12 +1705,16 @@ _gnutls_send_client_hello (gnutls_session_t session, int again)
   opaque rnd[GNUTLS_RANDOM_SIZE];
   gnutls_protocol_t hver;
   opaque extdata[MAX_EXT_DATA_LENGTH];
+  int rehandshake = 0;
 
   opaque *SessionID =
     session->internals.resumed_security_parameters.session_id;
   uint8_t session_id_len =
     session->internals.resumed_security_parameters.session_id_size;
 
+  if (session->security_parameters.session_id_size)
+    rehandshake = 1;
+
   if (SessionID == NULL)
     session_id_len = 0;
   else if (session_id_len == 0)
@@ -1734,7 +1738,12 @@ _gnutls_send_client_hello (gnutls_session_t session, int again)
        * version number to the previously established.
        */
       if (SessionID == NULL)
-       hver = _gnutls_version_max (session);
+        {
+          if (rehandshake) /* already negotiated version thus version_max == negotiated version */
+            hver = session->security_parameters.version;
+          else
+           hver = _gnutls_version_max (session);
+        }
       else
        {                       /* we are resuming a session */
          hver = session->internals.resumed_security_parameters.version;