| commit | c93242cab986087f06a4655d14fec18eecb7f5f4 | [log] [tgz] |
|---|---|---|
| author | Lukas Tribus <luky-37@hotmail.com> | Thu Nov 05 13:59:30 2015 +0100 |
| committer | Willy Tarreau <w@1wt.eu> | Thu Nov 05 14:10:06 2015 +0100 |
| tree | e69261ee8ee9c0aa8f7acfddbc699d249fa7619d | |
| parent | cf4fb036a47042c86c9e3138ef01a6136fd5db87 [diff] |
BUG/MINOR: acl: don't use record layer in req_ssl_ver
The initial record layer version in a SSL handshake may be set to TLSv1.0
or similar for compatibility reasons, this is allowed as per RFC5246
Appendix E.1 [1]. Some implementations are Openssl [2] and NSS [3].
A related issue has been fixed some time ago in commit 57d229747
("BUG/MINOR: acl: req_ssl_sni fails with SSLv3 record version").
Fix this by using the real client hello version instead of the record
layer version.
This was reported by Julien Vehent and analyzed by Cyril Bonté.
The initial patch is from Julien Vehent as well.
This should be backported to stable series, the req_ssl_ver keyword was
first introduced in 1.3.16.
[1] https://tools.ietf.org/html/rfc5246#appendix-E.1
[2] https://github.com/openssl/openssl/commit/4a1cf50187659e60c5867ecbbc36e37b2605d2c3
[3] https://bugzilla.mozilla.org/show_bug.cgi?id=774547