@@ -3386,6 +3386,8 @@ set_min_max_proto_version(PySSLContext *self, PyObject *arg, int what)
3386
3386
long min ;
3387
3387
long max ;
3388
3388
long v ;
3389
+ long prev ;
3390
+ long new ;
3389
3391
int result ;
3390
3392
3391
3393
if (!PyArg_Parse (arg , "l" , & v ))
@@ -3432,7 +3434,18 @@ set_min_max_proto_version(PySSLContext *self, PyObject *arg, int what)
3432
3434
);
3433
3435
return -1 ;
3434
3436
}
3437
+ prev = SSL_CTX_get_min_proto_version (self -> ctx );
3435
3438
result = SSL_CTX_set_min_proto_version (self -> ctx , v );
3439
+ new = SSL_CTX_get_min_proto_version (self -> ctx );
3440
+ #if defined(LIBRESSL_VERSION_NUMBER )
3441
+ if ((v != 0 && v != new ) ||
3442
+ (v == 0 && PY_PROTO_MINIMUM_AVAILABLE != new )) {
3443
+ PyErr_Format (PyExc_ValueError ,
3444
+ "Unsupported protocol version 0x%x" , v );
3445
+ SSL_CTX_set_min_proto_version (self -> ctx , prev );
3446
+ return -1 ;
3447
+ }
3448
+ #endif
3436
3449
}
3437
3450
else {
3438
3451
/* set_maximum_version */
@@ -3457,7 +3470,18 @@ set_min_max_proto_version(PySSLContext *self, PyObject *arg, int what)
3457
3470
);
3458
3471
return -1 ;
3459
3472
}
3473
+ prev = SSL_CTX_get_max_proto_version (self -> ctx );
3460
3474
result = SSL_CTX_set_max_proto_version (self -> ctx , v );
3475
+ new = SSL_CTX_get_max_proto_version (self -> ctx );
3476
+ #if defined(LIBRESSL_VERSION_NUMBER )
3477
+ if ((v != 0 && v != SSL_CTX_get_max_proto_version (self -> ctx )) ||
3478
+ (v == 0 && PY_PROTO_MAXIMUM_AVAILABLE != SSL_CTX_get_max_proto_version (self -> ctx ))) {
3479
+ PyErr_Format (PyExc_ValueError ,
3480
+ "Unsupported protocol version 0x%x" , v );
3481
+ result = SSL_CTX_set_max_proto_version (self -> ctx , prev );
3482
+ return -1 ;
3483
+ }
3484
+ #endif
3461
3485
}
3462
3486
if (result == 0 ) {
3463
3487
PyErr_Format (PyExc_ValueError ,
0 commit comments