diff options
| author | Benjamin Kaduk <bkaduk@akamai.com> | 2020-05-27 20:17:07 +0200 |
|---|---|---|
| committer | Benjamin Kaduk <bkaduk@akamai.com> | 2021-02-24 01:18:41 +0100 |
| commit | ce0b307ea01bc5e3e178cd4dba45f9bb9d4ba5df (patch) | |
| tree | ba0d93a9d31dfd0c97cf140574153e73f3938758 /ssl | |
| parent | make update (diff) | |
| download | openssl-ce0b307ea01bc5e3e178cd4dba45f9bb9d4ba5df.tar.xz openssl-ce0b307ea01bc5e3e178cd4dba45f9bb9d4ba5df.zip | |
Remove disabled TLS 1.3 ciphers from the SSL(_CTX)
In ssl_create_cipher_list() we make a pass through the ciphers to
remove those which are disabled in the current libctx. We are
careful to not include such disabled TLS 1.3 ciphers in the final
consolidated cipher list that we produce, but the disabled ciphers
are still kept in the separate stack of TLS 1.3 ciphers associated
with the SSL or SSL_CTX in question. This leads to confusing
results where a cipher is present in the tls13_cipherlist but absent
from the actual cipher list in use. Keep the books in order and
remove the disabled ciphers from the 1.3 cipherlist at the same time
we skip adding them to the active cipher list.
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12037)
Diffstat (limited to 'ssl')
| -rw-r--r-- | ssl/ssl_ciph.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/ssl/ssl_ciph.c b/ssl/ssl_ciph.c index d517799895..0b6f01ccc1 100644 --- a/ssl/ssl_ciph.c +++ b/ssl/ssl_ciph.c @@ -1625,8 +1625,11 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(SSL_CTX *ctx, if ((sslc->algorithm_enc & disabled_enc) != 0 || (ssl_cipher_table_mac[sslc->algorithm2 & SSL_HANDSHAKE_MAC_MASK].mask - & ctx->disabled_mac_mask) != 0) + & ctx->disabled_mac_mask) != 0) { + sk_SSL_CIPHER_delete(tls13_ciphersuites, i); + i--; continue; + } if (!sk_SSL_CIPHER_push(cipherstack, sslc)) { sk_SSL_CIPHER_free(cipherstack); |