Improve fallback protection

[openssl.git] / ssl / statem / statem_lib.c

diff --git a/ssl/statem/statem_lib.c b/ssl/statem/statem_lib.c
index 8a7d178a5108a141fec6966a6e14e0df23beabfc..74a2ec11de5e1c3e4d042e3932187cd222f604af 100644 (file)
--- a/ssl/statem/statem_lib.c
+++ b/ssl/statem/statem_lib.c
@@ -1914,6 +1914,9 @@ int ssl_choose_client_version(SSL *s, int version, RAW_EXTENSION *extensions)
         if (highver != 0 && s->version != vent->version)
             continue;
 
         if (highver != 0 && s->version != vent->version)
             continue;
 

+        if (highver == 0 && (s->mode & SSL_MODE_SEND_FALLBACK_SCSV) != 0)
+            highver = vent->version;
+

         method = vent->cmeth();
         err = ssl_method_error(s, method);
         if (err != 0) {
         method = vent->cmeth();
         err = ssl_method_error(s, method);
         if (err != 0) {