diff options
| author | Matt Caswell <matt@openssl.org> | 2018-02-16 11:26:02 +0000 |
|---|---|---|
| committer | Matt Caswell <matt@openssl.org> | 2018-03-14 10:15:50 +0000 |
| commit | f865b08143b453962ad4afccd69e698d13c60f77 (patch) | |
| tree | 9d1a2ae3fabc63589815a2426456417ec1d14f33 /test/clienthellotest.c | |
| parent | 5b68d1792021463b7cd5d76c82b251d61a56d869 (diff) | |
| download | openssl-f865b08143b453962ad4afccd69e698d13c60f77.zip openssl-f865b08143b453962ad4afccd69e698d13c60f77.tar.gz openssl-f865b08143b453962ad4afccd69e698d13c60f77.tar.bz2 | |
Split configuration of TLSv1.3 ciphers from older ciphers
With the current mechanism, old cipher strings that used to work in 1.1.0,
may inadvertently disable all TLSv1.3 ciphersuites causing connections to
fail. This is confusing for users.
In reality TLSv1.3 are quite different to older ciphers. They are much
simpler and there are only a small number of them so, arguably, they don't
need the same level of control that the older ciphers have.
This change splits the configuration of TLSv1.3 ciphers from older ones.
By default the TLSv1.3 ciphers are on, so you cannot inadvertently disable
them through your existing config.
Fixes #5359
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5392)
Diffstat (limited to 'test/clienthellotest.c')
| -rw-r--r-- | test/clienthellotest.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/test/clienthellotest.c b/test/clienthellotest.c index 5cff519..45595d3 100644 --- a/test/clienthellotest.c +++ b/test/clienthellotest.c @@ -97,8 +97,7 @@ static int test_client_hello(int currtest) * ClientHello is already going to be quite long. To avoid getting one * that is too long for this test we use a restricted ciphersuite list */ - if (!TEST_true(SSL_CTX_set_cipher_list(ctx, - "TLS13-AES-128-GCM-SHA256"))) + if (!TEST_true(SSL_CTX_set_cipher_list(ctx, ""))) goto end; /* Fall through */ case TEST_ADD_PADDING: |