diff options
| author | Sam Roberts <rsam@ca.ibm.com> | 2018-11-26 13:58:52 -0800 |
|---|---|---|
| committer | Matt Caswell <matt@openssl.org> | 2019-02-14 13:54:56 +0000 |
| commit | 3c83c5ba4f6502c708b7a5f55c98a10e312668da (patch) | |
| tree | ca6386b1af5c76a460a3489ce7504d6747568b00 /ssl | |
| parent | f11ffa505f8a9345145a26a05bf77b012b6941bd (diff) | |
| download | openssl-3c83c5ba4f6502c708b7a5f55c98a10e312668da.zip openssl-3c83c5ba4f6502c708b7a5f55c98a10e312668da.tar.gz openssl-3c83c5ba4f6502c708b7a5f55c98a10e312668da.tar.bz2 | |
Ignore cipher suites when setting cipher list
set_cipher_list() sets TLSv1.2 (and below) ciphers, and its success or
failure should not depend on whether set_ciphersuites() has been used to
setup TLSv1.3 ciphers.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Ben Kaduk <kaduk@mit.edu>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7759)
Diffstat (limited to 'ssl')
| -rw-r--r-- | ssl/ssl_lib.c | 24 |
1 files changed, 22 insertions, 2 deletions
diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c index b001da7..322a438 100644 --- a/ssl/ssl_lib.c +++ b/ssl/ssl_lib.c @@ -2579,6 +2579,26 @@ STACK_OF(SSL_CIPHER) *SSL_CTX_get_ciphers(const SSL_CTX *ctx) return NULL; } +/* + * Distinguish between ciphers controlled by set_ciphersuite() and + * set_cipher_list() when counting. + */ +static int cipher_list_tls12_num(STACK_OF(SSL_CIPHER) *sk) +{ + int i, num = 0; + const SSL_CIPHER *c; + + if (sk == NULL) + return 0; + for (i = 0; i < sk_SSL_CIPHER_num(sk); ++i) { + c = sk_SSL_CIPHER_value(sk, i); + if (c->min_tls >= TLS1_3_VERSION) + continue; + num++; + } + return num; +} + /** specify the ciphers to be used by default by the SSL_CTX */ int SSL_CTX_set_cipher_list(SSL_CTX *ctx, const char *str) { @@ -2596,7 +2616,7 @@ int SSL_CTX_set_cipher_list(SSL_CTX *ctx, const char *str) */ if (sk == NULL) return 0; - else if (sk_SSL_CIPHER_num(sk) == 0) { + else if (cipher_list_tls12_num(sk) == 0) { SSLerr(SSL_F_SSL_CTX_SET_CIPHER_LIST, SSL_R_NO_CIPHER_MATCH); return 0; } @@ -2614,7 +2634,7 @@ int SSL_set_cipher_list(SSL *s, const char *str) /* see comment in SSL_CTX_set_cipher_list */ if (sk == NULL) return 0; - else if (sk_SSL_CIPHER_num(sk) == 0) { + else if (cipher_list_tls12_num(sk) == 0) { SSLerr(SSL_F_SSL_SET_CIPHER_LIST, SSL_R_NO_CIPHER_MATCH); return 0; } |