Update from 1.0.0-stable
diff --git a/ssl/s23_clnt.c b/ssl/s23_clnt.c
index 0912528..a71311e 100644
--- a/ssl/s23_clnt.c
+++ b/ssl/s23_clnt.c
@@ -250,6 +250,20 @@
return(ret);
}
+static int ssl23_no_ssl2_ciphers(SSL *s)
+ {
+ SSL_CIPHER *cipher;
+ STACK_OF(SSL_CIPHER) *ciphers;
+ int i;
+ ciphers = SSL_get_ciphers(s);
+ for (i = 0; i < sk_SSL_CIPHER_num(ciphers); i++)
+ {
+ cipher = sk_SSL_CIPHER_value(ciphers, i);
+ if (cipher->algorithm_ssl == SSL_SSLV2)
+ return 0;
+ }
+ return 1;
+ }
static int ssl23_client_hello(SSL *s)
{
@@ -264,6 +278,9 @@
ssl2_compat = (s->options & SSL_OP_NO_SSLv2) ? 0 : 1;
+ if (ssl2_compat && ssl23_no_ssl2_ciphers(s))
+ ssl2_compat = 0;
+
if (!(s->options & SSL_OP_NO_TLSv1))
{
version = TLS1_VERSION;
