mirror of
https://github.com/cuberite/polarssl.git
synced 2025-09-08 14:49:59 -04:00

TLS-RSA-WITH-NULL-SHA256, like other SHA256-based cipher suites, was first introduced in TLS 1.2. Mbed TLS accepts it in earlier protocol versions as well. This is technically a bug, which older versions of GnuTLS also have. GnuTLS 3.4.7 fixed this bug. Adapt compat.sh to automatically omit TLS-RSA-WITH-NULL-SHA256 in invalid protocol versions if GnuTLS doesn't support it. It's already not included in invalid protocol versions in OpenSSL interoperability testing. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>