denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

tls-crypto: Don't filter suites with specific ECDH group if any is available

Browse Source 
Since DH groups (or with TLS < 1.3 curves) are negotiated separately,
it doesn't matter which one is listed in the cipher suite as any one could
be used.
This commit is contained in:
Tobias Brunner
2021-02-12 14:35:23 +01:00
parent 85bde019d3
commit 311405c34d
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libtls/tls_crypto.c
+4 -2
View File
@@ -837,8 +837,10 @@ static void filter_suite(suite_algs_t suites[], int *count, int offset,
} }
if (current.dh && current.dh != suites[i].dh) if (current.dh && current.dh != suites[i].dh)
{ {
if (suites[i].dh != MODP_NONE) if (suites[i].dh != MODP_NONE &&
{ /* skip DH group, does not match nor NONE */ !(diffie_hellman_group_is_ec(current.dh) &&
diffie_hellman_group_is_ec(suites[i].dh)))
{ /* skip DH group, does not match nor NONE nor both ECDH */
continue; continue;
} }
} }