ims-volte-vowifi
/
strongswan
9
0
Fork 0
Code Pull Requests Releases Activity

tls-crypto: Don't filter suites with specific ECDH group if any is available 

Since DH groups (or with TLS < 1.3 curves) are negotiated separately,
it doesn't matter which one is listed in the cipher suite as any one could
be used.
This commit is contained in:
Tobias Brunner 2021-02-11 17:09:04 +01:00
parent 85bde019d3
commit 311405c34d
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/libtls/tls_crypto.c
View File

@ -837,8 +837,10 @@ static void filter_suite(suite_algs_t suites[], int *count, int offset,
}
if (current.dh && current.dh != suites[i].dh)
{
if (suites[i].dh != MODP_NONE)
{ /* skip DH group, does not match nor NONE */
if (suites[i].dh != MODP_NONE &&
!(diffie_hellman_group_is_ec(current.dh) &&
diffie_hellman_group_is_ec(suites[i].dh)))
{ /* skip DH group, does not match nor NONE nor both ECDH */
continue;
}
}