From 1ed5fdcb034b4930f1a7243313d40f80fd281287 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?P=C3=A9ter=20Dimitrov?= <peterdmv@erlang.org>
Date: Tue, 27 Nov 2018 16:44:11 +0100
Subject: ssl: Fix cipher suite selection

Accept only TLS 1.3 ciphers when TLS 1.3 is selected.

Change-Id: I4e934d344f52208263ffdeb31c357dd5727472b9
---
 lib/ssl/src/tls_v1.erl | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

(limited to 'lib/ssl/src/tls_v1.erl')

diff --git a/lib/ssl/src/tls_v1.erl b/lib/ssl/src/tls_v1.erl
index c964908122..d018f613c9 100644
--- a/lib/ssl/src/tls_v1.erl
+++ b/lib/ssl/src/tls_v1.erl
@@ -411,7 +411,7 @@ mac_hash(Method, Mac_write_secret, Seq_num, Type, {Major, Minor},
 
 %% TODO 1.3 same as above?
 
--spec suites(1|2|3|4) -> [ssl_cipher_format:cipher_suite()].
+-spec suites(1|2|3|4|'TLS_v1.3') -> [ssl_cipher_format:cipher_suite()].
 
 suites(Minor) when Minor == 1; Minor == 2 ->
     [
@@ -472,7 +472,17 @@ suites(4) ->
      %% Not supported
      %% ?TLS_AES_128_CCM_SHA256,
      %% ?TLS_AES_128_CCM_8_SHA256
-    ] ++ suites(3).
+    ] ++ suites(3);
+
+suites('TLS_v1.3') ->
+    [?TLS_AES_256_GCM_SHA384,
+     ?TLS_AES_128_GCM_SHA256,
+     ?TLS_CHACHA20_POLY1305_SHA256
+     %% Not supported
+     %% ?TLS_AES_128_CCM_SHA256,
+     %% ?TLS_AES_128_CCM_8_SHA256
+    ].
+
 
 signature_algs({3, 4}, HashSigns) ->
     signature_algs({3, 3}, HashSigns);
-- 
cgit v1.2.3