commit 2fbefde1d825f570b8abd3ea3fc3cdc75294b843
author Paul Bakker <p.j.bakker@polarssl.org> Sat Jun 29 16:01:15 2013 +0200
committer Paul Bakker <p.j.bakker@polarssl.org> Sat Jun 29 18:35:40 2013 +0200
tree 4b62f9499fadf853206ca4c3375a83c5fb202de4
parent 59c28a2723a8d15e0e48cb841c4022fabc64039e

Client and server now filter sent and accepted ciphersuites on minimum
and maximum protocol version

library/ssl_cli.c

diff --git a/library/ssl_cli.c b/library/ssl_cli.c
index 49b11cd..53557f8 100644
--- a/library/ssl_cli.c
+++ b/library/ssl_cli.c
@@ -255,9 +255,10 @@
     int ret;
     size_t i, n, olen, ext_len = 0;
     unsigned char *buf;
-    unsigned char *p;
+    unsigned char *p, *q;
     time_t t;
     const int *ciphersuites;
+    const ssl_ciphersuite_t *ciphersuite_info;
 
     SSL_DEBUG_MSG( 2, ( "=> write client hello" ) );
 
@@ -331,10 +332,11 @@
     SSL_DEBUG_BUF( 3,   "client hello, session id", buf + 39, n );
 
     ciphersuites = ssl->ciphersuite_list[ssl->minor_ver];
-    for( n = 0; ciphersuites[n] != 0; n++ );
-    if( ssl->renegotiation == SSL_INITIAL_HANDSHAKE ) n++;
-    *p++ = (unsigned char)( n >> 7 );
-    *p++ = (unsigned char)( n << 1 );
+    n = 0;
+    q = p;
+
+    // Skip writing ciphersuite length for now
+    p += 2;
 
     /*
      * Add TLS_EMPTY_RENEGOTIATION_INFO_SCSV
@@ -343,20 +345,34 @@
     {
         *p++ = (unsigned char)( SSL_EMPTY_RENEGOTIATION_INFO >> 8 );
         *p++ = (unsigned char)( SSL_EMPTY_RENEGOTIATION_INFO      );
-        n--;
+        n++;
     }
 
-    SSL_DEBUG_MSG( 3, ( "client hello, got %d ciphersuites", n ) );
-
-    for( i = 0; i < n; i++ )
+    for( i = 0; ciphersuites[i] != 0; i++ )
     {
+        ciphersuite_info = ssl_ciphersuite_from_id( ciphersuites[i] );
+
+        if( ciphersuite_info == NULL )
+            continue;
+
+        if( ciphersuite_info->min_minor_ver > ssl->max_minor_ver ||
+            ciphersuite_info->max_minor_ver < ssl->min_minor_ver )
+            continue;
+
         SSL_DEBUG_MSG( 3, ( "client hello, add ciphersuite: %2d",
                        ciphersuites[i] ) );
 
+        n++;
         *p++ = (unsigned char)( ciphersuites[i] >> 8 );
         *p++ = (unsigned char)( ciphersuites[i]      );
     }
 
+    *q++ = (unsigned char)( n >> 7 );
+    *q++ = (unsigned char)( n << 1 );
+
+    SSL_DEBUG_MSG( 3, ( "client hello, got %d ciphersuites", n ) );
+
+
 #if defined(POLARSSL_ZLIB_SUPPORT)
     SSL_DEBUG_MSG( 3, ( "client hello, compress len.: %d", 2 ) );
     SSL_DEBUG_MSG( 3, ( "client hello, compress alg.: %d %d",