[ssl] Add SSL_kDHEPSK and SSL_kECDHEPSK as PFS ciphersuites for SECLE…

…VEL >= 3 Fixes openssl#17743
romen · Feb 23, 2022 · ecd3acc · ecd3acc
1 parent b22dc06
commit ecd3acc
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/ssl/ssl_cert.c b/ssl/ssl_cert.c
@@ -1001,7 +1001,7 @@ static int ssl_security_default_callback(const SSL *s, const SSL_CTX *ctx,
                                          int op, int bits, int nid, void *other,
                                          void *ex)
 {
-    int level, minbits;
+    int level, minbits, pfs_mask;
 
     minbits = ssl_get_security_level_bits(s, ctx, &level);
 
@@ -1033,8 +1033,9 @@ static int ssl_security_default_callback(const SSL *s, const SSL_CTX *ctx,
             if (minbits > 160 && c->algorithm_mac & SSL_SHA1)
                 return 0;
             /* Level 3: forward secure ciphersuites only */
+            pfs_mask = SSL_kDHE | SSL_kECDHE | SSL_kDHEPSK | SSL_kECDHEPSK;
             if (level >= 3 && c->min_tls != TLS1_3_VERSION &&
-                               !(c->algorithm_mkey & (SSL_kDHE | SSL_kECDHE)))
+                               !(c->algorithm_mkey & pfs_mask))
                 return 0;
             break;
         }