X-Git-Url: https://git.openssl.org/gitweb/?p=openssl.git;a=blobdiff_plain;f=ssl%2Fstatem%2Fstatem_clnt.c;h=338325f7779c3528009a177bf189a1ae75cbb000;hp=fdf5d451df317fc33981fa1c1ef269d3fd11478c;hb=61278ff3f952570a3ca06d02b07502069cd78f55;hpb=a2b97bdf3dbbd255ee24aa8a74cf88d4f7034898;ds=sidebyside

diff --git a/ssl/statem/statem_clnt.c b/ssl/statem/statem_clnt.c
index fdf5d451df..338325f777 100644
--- a/ssl/statem/statem_clnt.c
+++ b/ssl/statem/statem_clnt.c
@@ -1569,6 +1569,13 @@ static MSG_PROCESS_RETURN tls_process_hello_retry_request(SSL *s, PACKET *pkt)
         goto f_err;
     }
 
+    /* TODO(TLS1.3): Remove the TLS1_3_VERSION_DRAFT clause before release */
+    if (sversion != TLS1_3_VERSION && sversion != TLS1_3_VERSION_DRAFT) {
+        SSLerr(SSL_F_TLS_PROCESS_HELLO_RETRY_REQUEST, SSL_R_WRONG_SSL_VERSION);
+        al = SSL_AD_PROTOCOL_VERSION;
+        goto f_err;
+    }
+
     s->hello_retry_request = 1;
 
     /*