diff options
| author | Ingela Anderton Andin <[email protected]> | 2018-08-06 13:04:25 +0200 |
|---|---|---|
| committer | Ingela Anderton Andin <[email protected]> | 2018-08-06 14:35:26 +0200 |
| commit | 1e82b6329a8b53467453aba1ec52309094ab489d (patch) | |
| tree | cd1d637cd03f523e7526942be01816994da9b3cd | |
| parent | 757057b32f60fc1626af9593b49975f40fcceefd (diff) | |
| download | otp-1e82b6329a8b53467453aba1ec52309094ab489d.tar.gz otp-1e82b6329a8b53467453aba1ec52309094ab489d.tar.bz2 otp-1e82b6329a8b53467453aba1ec52309094ab489d.zip | |
ssl: Make sure that a correct cipher suite is selected
The keyexchange ECDHE-RSA requires an RSA-keyed server cert
(corresponding for ECDHE-ECDSA), the code did not assert this
resulting in that a incorrect cipher suite could be selected.
Alas test code was also wrong hiding the error.
| -rw-r--r-- | lib/ssl/src/ssl_cipher.erl | 4 | ||||
| -rw-r--r-- | lib/ssl/test/ssl_test_lib.erl | 5 |
2 files changed, 4 insertions, 5 deletions
diff --git a/lib/ssl/src/ssl_cipher.erl b/lib/ssl/src/ssl_cipher.erl index 40d974f6a5..aa453fe3f1 100644 --- a/lib/ssl/src/ssl_cipher.erl +++ b/lib/ssl/src/ssl_cipher.erl @@ -2555,6 +2555,8 @@ ecdsa_signed_suites(Ciphers, Version) -> rsa_keyed(dhe_rsa) -> true; +rsa_keyed(ecdhe_rsa) -> + true; rsa_keyed(rsa) -> true; rsa_keyed(rsa_psk) -> @@ -2618,6 +2620,8 @@ ec_keyed(ecdh_ecdsa) -> true; ec_keyed(ecdh_rsa) -> true; +ec_keyed(ecdhe_ecdsa) -> + true; ec_keyed(_) -> false. diff --git a/lib/ssl/test/ssl_test_lib.erl b/lib/ssl/test/ssl_test_lib.erl index ed02b795ab..3e6c5e8b8a 100644 --- a/lib/ssl/test/ssl_test_lib.erl +++ b/lib/ssl/test/ssl_test_lib.erl @@ -1417,11 +1417,6 @@ v_1_2_check(ecdh_ecdsa, ecdh_rsa) -> true; v_1_2_check(ecdh_rsa, ecdh_ecdsa) -> true; -v_1_2_check(ecdhe_ecdsa, ecdhe_rsa) -> - true; -v_1_2_check(ecdhe_rsa, ecdhe_ecdsa) -> - true; - v_1_2_check(_, _) -> false. |