From: Pierre Cheynier Date: Thu, 21 Mar 2019 16:15:47 +0000 (+0000) Subject: BUG/MEDIUM: ssl: ability to set TLS 1.3 ciphers using ssl-default-server-ciphersuites X-Git-Tag: v2.0-dev2~21 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=bc34cd1de2ee80de63b5c4d319a501fc0d4ea2f5;p=thirdparty%2Fhaproxy.git BUG/MEDIUM: ssl: ability to set TLS 1.3 ciphers using ssl-default-server-ciphersuites Any attempt to put TLS 1.3 ciphers on servers failed with output 'unable to set TLS 1.3 cipher suites'. This was due to usage of SSL_CTX_set_cipher_list instead of SSL_CTX_set_ciphersuites in the TLS 1.3 block (protected by OPENSSL_VERSION_NUMBER >= 0x10101000L & so). This should be backported to 1.9 and 1.8. Signed-off-by: Pierre Cheynier Reported-by: Damien Claisse Cc: Emeric Brun --- diff --git a/src/ssl_sock.c b/src/ssl_sock.c index 138b1c58ce..47548edc18 100644 --- a/src/ssl_sock.c +++ b/src/ssl_sock.c @@ -4785,7 +4785,7 @@ int ssl_sock_prepare_srv_ctx(struct server *srv) #if (OPENSSL_VERSION_NUMBER >= 0x10101000L && !defined OPENSSL_IS_BORINGSSL && !defined LIBRESSL_VERSION_NUMBER) if (srv->ssl_ctx.ciphersuites && - !SSL_CTX_set_cipher_list(srv->ssl_ctx.ctx, srv->ssl_ctx.ciphersuites)) { + !SSL_CTX_set_ciphersuites(srv->ssl_ctx.ctx, srv->ssl_ctx.ciphersuites)) { ha_alert("Proxy '%s', server '%s' [%s:%d] : unable to set TLS 1.3 cipher suites to '%s'.\n", curproxy->id, srv->id, srv->conf.file, srv->conf.line, srv->ssl_ctx.ciphersuites);