ssl/ssl_ciph.c: interim solution for assertion in d1_pkt.c(444).

[openssl.git] / ssl / ssl_ciph.c

diff --git a/ssl/ssl_ciph.c b/ssl/ssl_ciph.c
index c12a7a22d2b194fbd64bcab73716bdbb2deb7566..a96a5daaf5d2b9c3404b78eea04f9f3bb96b8679 100644 (file)
--- a/ssl/ssl_ciph.c
+++ b/ssl/ssl_ciph.c
@@ -616,18 +616,19 @@ int ssl_cipher_get_evp(const SSL_SESSION *s, const EVP_CIPHER **enc,
                {
                const EVP_CIPHER *evp;
 
-               if      (s->ssl_version >= TLS1_VERSION &&
-                        c->algorithm_enc == SSL_RC4 &&
+               if (s->ssl_version>>8 != TLS1_VERSION_MAJOR ||
+                   s->ssl_version < TLS1_VERSION)
+                       return 1;
+
+               if      (c->algorithm_enc == SSL_RC4 &&
                         c->algorithm_mac == SSL_MD5 &&
                         (evp=EVP_get_cipherbyname("RC4-HMAC-MD5")))
                        *enc = evp, *md = NULL;
-               else if (s->ssl_version >= TLS1_VERSION &&
-                        c->algorithm_enc == SSL_AES128 &&
+               else if (c->algorithm_enc == SSL_AES128 &&
                         c->algorithm_mac == SSL_SHA1 &&
                         (evp=EVP_get_cipherbyname("AES-128-CBC-HMAC-SHA1")))
                        *enc = evp, *md = NULL;
-               else if (s->ssl_version >= TLS1_VERSION &&
-                        c->algorithm_enc == SSL_AES256 &&
+               else if (c->algorithm_enc == SSL_AES256 &&
                         c->algorithm_mac == SSL_SHA1 &&
                         (evp=EVP_get_cipherbyname("AES-256-CBC-HMAC-SHA1")))
                        *enc = evp, *md = NULL;