[gnutls-devel] GnuTLS | gnutls_priority_set: do not override version on handshake (!765)

[Development of GNU's TLS library]

Nikos Mavrogiannopoulos commented on a discussion on lib/handshake.c:

> -			 * earlier, as TLS1.3 uses a different set of ciphersuites, and
> -			 * thus we cannot fallback.
> -			 */
> -			ret = _gnutls_negotiate_version(session, major, minor, 0);
> -			if (ret < 0) {
> -				gnutls_assert();
> -				return ret;
> +		/* to catch any changes in the TLS protocol negotiation */
> +		if (session->internals.resumed != RESUME_TRUE) {
> +			new_max = _gnutls_version_max(session);
> +			old_vers = get_version(session);
> +
> +			if (!old_vers->tls13_sem || (new_max && !new_max->tls13_sem)) {
> +				/* Here we need to renegotiate the version since the callee might
> +				 * have disabled some TLS versions. This will not work for protocols
> +				 * > TLS1.3.

It is for future protocols to TLS1.3. I've updated the text for more clarity.

-- 
Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/merge_requests/765#note_106127453
You're receiving this email because of your account on gitlab.com.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.gnupg.org/pipermail/gnutls-devel/attachments/20181003/a33dcd97/attachment-0001.html>