tree 9d7635a3d66f186d913953d551d95838fe066cc0
parent 073edf3311aa963ca7e0496f70b848b5f1fe9ec3
author Lukas Tribus <luky-37@hotmail.com> 1397158582 +0200
committer Willy Tarreau <w@1wt.eu> 1397165459 +0200
encoding latin1

BUG/MINOR: acl: req_ssl_sni fails with SSLv3 record version

SNI is a TLS extension and requires at least TLSv1.0 or later, however
the version in the record layer may be SSLv3, not necessarily TLSv1.0.

GnuTLS for example does this.

Relax the record layer version check in smp_fetch_ssl_hello_sni() to
allow fetching SNI values from clients indicating SSLv3 in the record
layer (maintaining the TLSv1.0+ check in the actual handshake version).

This was reported and analyzed by Pravin Tatti.