Set TLS v1.2 disabled mask properly.

[openssl.git] / ssl / s3_clnt.c

diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c
index 87d738cdf9e2dfcf2a3a825dd5a968c899805b38..24c180c4d7294a961463fe5a49a3fbdf6d9b9b28 100644 (file)
--- a/ssl/s3_clnt.c
+++ b/ssl/s3_clnt.c
@@ -1073,6 +1073,11 @@ int ssl3_get_server_hello(SSL *s)
                SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_UNKNOWN_CIPHER_RETURNED);
                goto f_err;
                }
+       /* Set version disabled mask now we know version */
+       if (!SSL_USE_TLS1_2_CIPHERS(s))
+               ct->mask_ssl = SSL_TLSV1_2;
+       else
+               ct->mask_ssl = 0;
        /* If it is a disabled cipher we didn't send it in client hello,
         * so return an error.
         */
@@ -3564,9 +3569,11 @@ int ssl3_check_finished(SSL *s)
        {
        int ok;
        long n;
-/*     Read the message to see if it is supplemental data, regardless if there is a session ticket
-       this function is called when we really expect a Certificate
-       message, so permit appropriate message length */
+
+       /* Read the message to see if it is supplemental data,
+        * regardless if there is a session ticket this function is
+        * called when we really expect a Certificate message, so
+        * permit appropriate message length */
        n=s->method->ssl_get_message(s,
                SSL3_ST_CR_CERT_A,
                SSL3_ST_CR_CERT_B,
@@ -3577,9 +3584,7 @@ int ssl3_check_finished(SSL *s)
        s->s3->tmp.reuse_message = 1;
 
        if (s->s3->tmp.message_type == SSL3_MT_SUPPLEMENTAL_DATA)
-               {
                return 3;
-               }
        /* If we have no ticket it cannot be a resumed session. */
        if (!s->session->tlsext_tick)
                return 1;
@@ -3727,7 +3732,7 @@ int tls1_get_server_supplemental_data(SSL *s)
                goto f_err;
                }
        n2l3(p, supp_data_len);
-       while (p<d+supp_data_len)
+       while (p < d+supp_data_len)
                {
                n2s(p, supp_data_entry_type);
                n2s(p, supp_data_entry_len);
@@ -3744,7 +3749,7 @@ int tls1_get_server_supplemental_data(SSL *s)
                                        }
                                }
                        }
-               p+=supp_data_entry_len;
+               p += supp_data_entry_len;
                }
        return 1;
 f_err: