]> git.ipfire.org Git - thirdparty/haproxy.git/commit
BUG/MEDIUM: ssl: AWS-LC + TLSv1.3 won't do ECDSA in RSA+ECDSA configuration
authorWilliam Lallemand <wlallemand@haproxy.com>
Fri, 14 Jun 2024 22:25:16 +0000 (00:25 +0200)
committerWilliam Lallemand <wlallemand@haproxy.com>
Mon, 17 Jun 2024 15:40:49 +0000 (17:40 +0200)
commited9b8fec49d23cb65484f7e21d5886aa2a50ce98
treeb53322f8016276c02f4996d1e5c74fe622fc362a
parent6da0879083749d5f098b8b2f4d459a70260491d2
BUG/MEDIUM: ssl: AWS-LC + TLSv1.3 won't do ECDSA in RSA+ECDSA configuration

SSL_get_ciphers() in AWS-LC seems to lack the TLSv1.3 ciphersuites,
which break the ECDSA key selection when doing TLSv1.3.

An issue was opened https://github.com/aws/aws-lc/issues/1638

Indeed, in ssl_sock_switchctx_cbk(), the sigalgs is used to determine if
ECDSA is doable or not, then the function compares the list of ciphers in
the clienthello with the list of configured ciphers.

The fix solves the issue by never skipping the TLSv1.3 ciphersuites,
even if they are not in SSL_get_ciphers().
src/ssl_clienthello.c