From 804710bfbb52ebb3883f885be210fc3093198cc8 Mon Sep 17 00:00:00 2001
From: tb <>
Date: Wed, 29 Jun 2022 08:37:18 +0000
Subject: Also check the security level when choosing a shared cipher

ok beck jsing
---
 src/lib/libssl/s3_lib.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

(limited to 'src')

diff --git a/src/lib/libssl/s3_lib.c b/src/lib/libssl/s3_lib.c
index b4ad11dc6e..66d0eba9a0 100644
--- a/src/lib/libssl/s3_lib.c
+++ b/src/lib/libssl/s3_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: s3_lib.c,v 1.229 2022/06/29 08:30:04 tb Exp $ */
+/* $OpenBSD: s3_lib.c,v 1.230 2022/06/29 08:37:18 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -2527,6 +2527,10 @@ ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
 		    !(c->algorithm_ssl & SSL_TLSV1_3))
 			continue;
 
+		if (!ssl_security(s, SSL_SECOP_CIPHER_SHARED, c->strength_bits,
+		    0, c))
+			continue;
+
 		ssl_set_cert_masks(cert, c);
 		mask_k = cert->mask_k;
 		mask_a = cert->mask_a;
-- 
cgit v1.2.3-55-g6feb