From 1e82b6329a8b53467453aba1ec52309094ab489d Mon Sep 17 00:00:00 2001 From: Ingela Anderton Andin Date: Mon, 6 Aug 2018 13:04:25 +0200 Subject: ssl: Make sure that a correct cipher suite is selected The keyexchange ECDHE-RSA requires an RSA-keyed server cert (corresponding for ECDHE-ECDSA), the code did not assert this resulting in that a incorrect cipher suite could be selected. Alas test code was also wrong hiding the error. --- lib/ssl/src/ssl_cipher.erl | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'lib/ssl/src') diff --git a/lib/ssl/src/ssl_cipher.erl b/lib/ssl/src/ssl_cipher.erl index 40d974f6a5..aa453fe3f1 100644 --- a/lib/ssl/src/ssl_cipher.erl +++ b/lib/ssl/src/ssl_cipher.erl @@ -2555,6 +2555,8 @@ ecdsa_signed_suites(Ciphers, Version) -> rsa_keyed(dhe_rsa) -> true; +rsa_keyed(ecdhe_rsa) -> + true; rsa_keyed(rsa) -> true; rsa_keyed(rsa_psk) -> @@ -2618,6 +2620,8 @@ ec_keyed(ecdh_ecdsa) -> true; ec_keyed(ecdh_rsa) -> true; +ec_keyed(ecdhe_ecdsa) -> + true; ec_keyed(_) -> false. -- cgit v1.2.3