From c6ea08836bb97555194afb6fd1a81fd9da29985a Mon Sep 17 00:00:00 2001 From: Tomas Mraz Date: Tue, 14 Aug 2018 15:03:16 +0200 Subject: [PATCH] Allow TLS-1.3 ciphersuites in @SECLEVEL=3 and above The TLS-1.3 ciphersuites must not be blocked by @SECLEVEL=3 even though they are not explicitly marked as using DH/ECDH. Reviewed-by: Kurt Roeckx Reviewed-by: Paul Dale Reviewed-by: Rich Salz (Merged from https://github.com/openssl/openssl/pull/6959) --- ssl/ssl_cert.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ssl/ssl_cert.c b/ssl/ssl_cert.c index df5cff79c9..e740a8c25d 100644 --- a/ssl/ssl_cert.c +++ b/ssl/ssl_cert.c @@ -947,7 +947,8 @@ static int ssl_security_default_callback(const SSL *s, const SSL_CTX *ctx, if (level >= 2 && c->algorithm_enc == SSL_RC4) return 0; /* Level 3: forward secure ciphersuites only */ - if (level >= 3 && !(c->algorithm_mkey & (SSL_kEDH | SSL_kEECDH))) + if (level >= 3 && (c->min_tls != TLS1_3_VERSION || + !(c->algorithm_mkey & (SSL_kEDH | SSL_kEECDH)))) return 0; break; } -- 2.34.1