MINOR: ssl: check TLS1.3 ciphersuites again in clienthello with recent AWS-LC
authorWilliam Lallemand <wlallemand@haproxy.com>
Mon, 30 Jun 2025 14:20:29 +0000 (16:20 +0200)
committerChristopher Faulet <cfaulet@haproxy.com>
Tue, 26 Aug 2025 06:30:03 +0000 (08:30 +0200)
commit04ee2289825b53958576097f891e5b44e47532c0
treec212bf9e226f5e1db699dd24459b0a8ffc6b15e7
parente29ba58d8dddfc834695d233fe8dd59e7c5409ca
MINOR: ssl: check TLS1.3 ciphersuites again in clienthello with recent AWS-LC

Patch ed9b8fec49 ("BUG/MEDIUM: ssl: AWS-LC + TLSv1.3 won't do ECDSA in
RSA+ECDSA configuration") partly fixed a cipher selection problem with
AWS-LC. However this was not checking anymore if the ciphersuites was
available in haproxy which is still a problem.

The problem was fixed in AWS-LC 1.46.0 with this PR
https://github.com/aws/aws-lc/pull/2092.

This patch allows to filter again the TLS13 ciphersuites with recent
versions of AWS-LC. However, since there are no macros to check the
AWS-LC version, it is enabled at the next AWS-LC API version change
following the fix in AWS-LC v1.50.0.

This could be backported where ed9b8fec49 was backported.

(cherry picked from commit 7fc8ab0397f01c58a31f203b4d97c79cff3ae244)
Signed-off-by: Willy Tarreau <w@1wt.eu>
(cherry picked from commit 860f5f0536a100c383c75779ff7a6ffbc434019c)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
src/ssl_clienthello.c