From: Benjamin Kaduk <bkaduk@akamai.com>
Date: Wed, 19 Sep 2018 14:02:04 +0000 (-0500)
Subject: Reset TLS 1.3 ciphers in SSL_CTX_set_ssl_version()
X-Git-Tag: openssl-3.0.0-alpha1~3106
X-Git-Url: https://git.openssl.org/?p=openssl.git;a=commitdiff_plain;h=2340ed277b7c5365e83a32eb7d5fa32c4071fb21;ds=sidebyside

Reset TLS 1.3 ciphers in SSL_CTX_set_ssl_version()

Historically SSL_CTX_set_ssl_version() has reset the cipher list
to the default.  Splitting TLS 1.3 ciphers to be tracked separately
caused a behavior change, in that TLS 1.3 cipher configuration was
preserved across calls to SSL_CTX_set_ssl_version().  To restore commensurate
behavior with the historical behavior, set the ciphersuites to the default as
well as setting the cipher list to the default.

Closes: #7226

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7270)
---

diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c
index d75158e30c..ec5b1554f7 100644
--- a/ssl/ssl_lib.c
+++ b/ssl/ssl_lib.c
@@ -654,6 +654,10 @@ int SSL_CTX_set_ssl_version(SSL_CTX *ctx, const SSL_METHOD *meth)
 
     ctx->method = meth;
 
+    if (!SSL_CTX_set_ciphersuites(ctx, TLS_DEFAULT_CIPHERSUITES)) {
+        SSLerr(SSL_F_SSL_CTX_SET_SSL_VERSION, SSL_R_SSL_LIBRARY_HAS_NO_CIPHERS);
+        return 0;
+    }
     sk = ssl_create_cipher_list(ctx->method,
                                 ctx->tls13_ciphersuites,
                                 &(ctx->cipher_list),