{"action":"created","issue":{"url":"https://api.github.com/repos/openssl/openssl/issues/7196","repository_url":"https://api.github.com/repos/openssl/openssl","labels_url":"https://api.github.com/repos/openssl/openssl/issues/7196/labels{/name}","comments_url":"https://api.github.com/repos/openssl/openssl/issues/7196/comments","events_url":"https://api.github.com/repos/openssl/openssl/issues/7196/events","html_url":"https://github.com/openssl/openssl/issues/7196","id":359287519,"node_id":"MDU6SXNzdWUzNTkyODc1MTk=","number":7196,"title":"SSL_CTX_set_cipher_list always adds TLS 1.3 ciphers","user":{"login":"reaperhulk","id":161495,"node_id":"MDQ6VXNlcjE2MTQ5NQ==","avatar_url":"https://avatars2.githubusercontent.com/u/161495?v=4","gravatar_id":"","url":"https://api.github.com/users/reaperhulk","html_url":"https://github.com/reaperhulk","followers_url":"https://api.github.com/users/reaperhulk/followers","following_url":"https://api.github.com/users/reaperhulk/following{/other_user}","gists_url":"https://api.github.com/users/reaperhulk/gists{/gist_id}","starred_url":"https://api.github.com/users/reaperhulk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/reaperhulk/subscriptions","organizations_url":"https://api.github.com/users/reaperhulk/orgs","repos_url":"https://api.github.com/users/reaperhulk/repos","events_url":"https://api.github.com/users/reaperhulk/events{/privacy}","received_events_url":"https://api.github.com/users/reaperhulk/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":6,"created_at":"2018-09-12T02:03:49Z","updated_at":"2018-09-12T15:15:28Z","closed_at":"2018-09-12T13:34:12Z","author_association":"CONTRIBUTOR","body":"In OpenSSL 1.1.0 and below if you passed a pattern to `SSL_CTX_set_cipher_list` that didn't match any ciphers the function would return 0 and not set any cipher suites. As of 1.1.1 the TLS 1.3 ciphers are added unconditionally https://github.com/openssl/openssl/blob/88ea3685e4bf30fc529fe46e19effc6317726de8/ssl/ssl_ciph.c#L1597-L1604 so this function can't return an empty cipher suite list. You can see this behavior with this example which will fail the assert under 1.1.1 but pass in 1.1.0.\r\n\r\n```c\r\n#include <openssl/ssl.h>\r\n#include <assert.h>\r\n\r\n\r\nint main(void) {\r\n    int res;\r\n    SSL_CTX *ctx = SSL_CTX_new(TLS_method());\r\n    res = SSL_CTX_set_cipher_list(ctx, \"nonsense\");\r\n    STACK_OF(SSL_CIPHER) *sk_ciphers = SSL_CTX_get_ciphers(ctx);\r\n    assert(sk_SSL_CIPHER_num(sk_ciphers) == 0);\r\n    return 0;\r\n}\r\n```\r\nAdditionally, even passing  the deprecated `TLSv1_2_method` to constrain the connection to 1.2 will add the ciphers.\r\n\r\nThe TLS 1.3 suites being added while ignoring the filter was presumably done to prevent situations where custom cipher suite specification would prevent the use of TLS 1.3, but the intermingling of TLS 1.3 and previous cipher suites here where the documented filter is not always applied is more than a little confusing."},"comment":{"url":"https://api.github.com/repos/openssl/openssl/issues/comments/420686754","html_url":"https://github.com/openssl/openssl/issues/7196#issuecomment-420686754","issue_url":"https://api.github.com/repos/openssl/openssl/issues/7196","id":420686754,"node_id":"MDEyOklzc3VlQ29tbWVudDQyMDY4Njc1NA==","user":{"login":"mattcaswell","id":7422273,"node_id":"MDQ6VXNlcjc0MjIyNzM=","avatar_url":"https://avatars0.githubusercontent.com/u/7422273?v=4","gravatar_id":"","url":"https://api.github.com/users/mattcaswell","html_url":"https://github.com/mattcaswell","followers_url":"https://api.github.com/users/mattcaswell/followers","following_url":"https://api.github.com/users/mattcaswell/following{/other_user}","gists_url":"https://api.github.com/users/mattcaswell/gists{/gist_id}","starred_url":"https://api.github.com/users/mattcaswell/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mattcaswell/subscriptions","organizations_url":"https://api.github.com/users/mattcaswell/orgs","repos_url":"https://api.github.com/users/mattcaswell/repos","events_url":"https://api.github.com/users/mattcaswell/events{/privacy}","received_events_url":"https://api.github.com/users/mattcaswell/received_events","type":"User","site_admin":false},"created_at":"2018-09-12T15:15:28Z","updated_at":"2018-09-12T15:15:28Z","author_association":"MEMBER","body":"I added an extra couple of sentences on the wiki page to be more explicit about the behaviour of `SSL_CTX_get_ciphers()`."}}
{"actor":{"display_login":"mattcaswell"}}