From e7db2efabf6d4bce492a81f797b974ca7a2dd1d3 Mon Sep 17 00:00:00 2001 From: Andy Green Date: Thu, 2 Nov 2023 09:56:20 +0000 Subject: [PATCH] mbedtls: if we have tls1.2 only accept exactly that --- lib/tls/mbedtls/wrapper/platform/ssl_pm.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/lib/tls/mbedtls/wrapper/platform/ssl_pm.c b/lib/tls/mbedtls/wrapper/platform/ssl_pm.c index e1b7ce2b2..3879e977b 100755 --- a/lib/tls/mbedtls/wrapper/platform/ssl_pm.c +++ b/lib/tls/mbedtls/wrapper/platform/ssl_pm.c @@ -183,7 +183,12 @@ int ssl_pm_new(SSL *ssl) mbedtls_ssl_conf_min_version(&ssl_pm->conf, MBEDTLS_SSL_MAJOR_VERSION_3, version); } else { mbedtls_ssl_conf_max_version(&ssl_pm->conf, MBEDTLS_SSL_MAJOR_VERSION_3, MBEDTLS_SSL_MINOR_VERSION_3); + +#if defined(MBEDTLS_SSL_PROTO_TLS1_2) + mbedtls_ssl_conf_min_version(&ssl_pm->conf, MBEDTLS_SSL_MAJOR_VERSION_3, MBEDTLS_SSL_MINOR_VERSION_3); +#else mbedtls_ssl_conf_min_version(&ssl_pm->conf, MBEDTLS_SSL_MAJOR_VERSION_3, 1); +#endif } mbedtls_ssl_conf_rng(&ssl_pm->conf, mbedtls_ctr_drbg_random, &ssl_pm->ctr_drbg);