From: Simon Josefsson <simon@josefsson.org>
Date: Mon, 30 Oct 2006 09:55:21 +0000 (+0000)
Subject: Have SSLv2 ClientHello's for unknown versions negotiate the highest
X-Git-Tag: gnutls_1_5_4~25
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=49a028aa404e624f5f7bbb0d0b7ae217cb69daf3;p=thirdparty%2Fgnutls.git

Have SSLv2 ClientHello's for unknown versions negotiate the highest
version we support, instead of the lowest.  Reported by
Pasi.Eronen@nokia.com.
---

diff --git a/lib/gnutls_v2_compat.c b/lib/gnutls_v2_compat.c
index 0cabf1e4e6..26fcec7091 100644
--- a/lib/gnutls_v2_compat.c
+++ b/lib/gnutls_v2_compat.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2001, 2004, 2005 Free Software Foundation
+ * Copyright (C) 2001, 2004, 2005, 2006 Free Software Foundation
  *
  * Author: Nikos Mavroyanopoulos
  *
@@ -117,11 +117,21 @@ _gnutls_read_client_hello_v2 (gnutls_session_t session, opaque * data,
 
   version = _gnutls_version_get (data[pos], data[pos + 1]);
 
-  /* if we do not support that version  
+  /* if we do not support that version
    */
   if (_gnutls_version_is_supported (session, version) == 0)
     {
-      ver = _gnutls_version_lowest (session);
+      /* If he requested something we do not support
+       * then we send him the highest we support.
+       */
+      ver = _gnutls_version_max (session);
+      if (ver == GNUTLS_VERSION_UNKNOWN)
+	{
+	  /* this check is not really needed.
+	   */
+	  gnutls_assert ();
+	  return GNUTLS_E_UNKNOWN_CIPHER_SUITE;
+	}
     }
   else
     {