From ce26c3410b909ac6a3b6467a194cd79210869e06 Mon Sep 17 00:00:00 2001
From: jsing <>
Date: Wed, 7 Nov 2018 01:53:36 +0000
Subject: Add TLSv1.3 cipher suites (with appropriate guards).

ok beck@ tb@
---
 src/lib/libssl/ssl_lib.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

(limited to 'src/lib/libssl/ssl_lib.c')

diff --git a/src/lib/libssl/ssl_lib.c b/src/lib/libssl/ssl_lib.c
index d8415bcf6d..3c4d116919 100644
--- a/src/lib/libssl/ssl_lib.c
+++ b/src/lib/libssl/ssl_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_lib.c,v 1.189 2018/09/05 16:58:59 jsing Exp $ */
+/* $OpenBSD: ssl_lib.c,v 1.190 2018/11/07 01:53:36 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -1424,6 +1424,11 @@ ssl_cipher_list_to_bytes(SSL *s, STACK_OF(SSL_CIPHER) *ciphers, CBB *cbb)
 		if ((cipher = sk_SSL_CIPHER_value(ciphers, i)) == NULL)
 			return 0;
 
+		/* Skip TLS v1.3 only ciphersuites if lower than v1.3 */
+		if ((cipher->algorithm_ssl & SSL_TLSV1_3) &&
+		    (TLS1_get_client_version(s) < TLS1_3_VERSION))
+			continue;
+
 		/* Skip TLS v1.2 only ciphersuites if lower than v1.2 */
 		if ((cipher->algorithm_ssl & SSL_TLSV1_2) &&
 		    (TLS1_get_client_version(s) < TLS1_2_VERSION))
-- 
cgit v1.2.3-55-g6feb