- Added option to add minimum accepted SSL/TLS protocol version
diff --git a/library/ssl_srv.c b/library/ssl_srv.c
index da34015..408d510 100644
--- a/library/ssl_srv.c
+++ b/library/ssl_srv.c
@@ -222,6 +222,18 @@
ssl->minor_ver = ( buf[5] <= SSL_MINOR_VERSION_3 )
? buf[5] : SSL_MINOR_VERSION_3;
+ if( ssl->minor_ver < ssl->min_minor_ver )
+ {
+ SSL_DEBUG_MSG( 1, ( "client only supports ssl smaller than minimum"
+ " [%d:%d] < [%d:%d]", ssl->major_ver, ssl->minor_ver,
+ buf[4], buf[5] ) );
+
+ ssl_send_alert_message( ssl, SSL_ALERT_LEVEL_FATAL,
+ SSL_ALERT_MSG_PROTOCOL_VERSION );
+
+ return( POLARSSL_ERR_SSL_BAD_HS_PROTOCOL_VERSION );
+ }
+
ssl->max_major_ver = buf[4];
ssl->max_minor_ver = buf[5];