Don't set client_version to the ServerHello version.

The client_version needs to be preserved for the RSA key exchange.

This change also means that renegotiation will, like TLS, repeat the old
client_version rather than advertise only the final version. (Either way,
version change on renego is not allowed.) This is necessary in TLS to work
around an SChannel bug, but it's not strictly necessary in DTLS.

(From BoringSSL)

Reviewed-by: Emilia Käsper <emilia@openssl.org>
(cherry picked from commit ec1af3c4195c1dfecdd9dc7458850ab1b8b951e0)

diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c
index c9b5ee18318c58bc191950f7ef7e96fe32a61db8..b16b3c44c0492db429fde7f8732f2b42719c0e23 100644 (file)
--- a/ssl/s3_clnt.c
+++ b/ssl/s3_clnt.c
@@ -941,7 +941,7 @@ int ssl3_get_server_hello(SSL *s)
                        al = SSL_AD_PROTOCOL_VERSION;
                        goto f_err;
                        }
-               s->version = s->client_version = s->method->version;
+               s->version = s->method->version;
                }
 
        if ((p[0] != (s->version>>8)) || (p[1] != (s->version&0xff)))