The "SHA256"/"SHA384" cipher aliases fail to be killed/removed simultaneously in non-strict mode

[aydinmercan]

Problem:

When using SSL_CTX_set_cipher_list, AWS-LC fails if both SHA256 and SHA384 aliases are either killed or removed.

Considering the following code:

#include <stdio.h>

#include <openssl/ssl.h>

static const char *list[] = {
	"HIGH:!SHA256:!SHA384", "HIGH:-SHA256:!SHA384", "HIGH:+SHA256:!SHA384",
	"HIGH:!SHA256:-SHA384", "HIGH:-SHA256:-SHA384", "HIGH:+SHA256:-SHA384",
	"HIGH:!SHA256:+SHA384", "HIGH:-SHA256:+SHA384", "HIGH:+SHA256:+SHA384",
	"HIGH:!SHA1:!SHA384",	"HIGH:-SHA1:!SHA384",	"HIGH:+SHA1:!SHA384",
	"HIGH:!SHA1:-SHA384",	"HIGH:-SHA1:-SHA384",	"HIGH:+SHA1:-SHA384",
	"HIGH:!SHA1:+SHA384",	"HIGH:-SHA1:+SHA384",	"HIGH:+SHA1:+SHA384",
	"HIGH:!OwO:!SHA384",	"HIGH:-OwO:!SHA384",	"HIGH:+OwO:!SHA384",
	"HIGH:!OwO:-SHA384",	"HIGH:-OwO:-SHA384",	"HIGH:+OwO:-SHA384",
	"HIGH:!OwO:+SHA384",	"HIGH:-OwO:+SHA384",	"HIGH:+OwO:+SHA384",
};

int
main() {
	__auto_type ctx = SSL_CTX_new(TLS_client_method());

	for (__auto_type i = 0; i < 27; i++) {
		if (SSL_CTX_set_cipher_list(ctx, list[i]) != 1) {
			fprintf(stderr, "%s\n", list[i]);
		}
	}
}

With AWS-LC, I get the following output whereas it should've been empty:

HIGH:!SHA256:!SHA384
HIGH:-SHA256:!SHA384
HIGH:!SHA256:-SHA384
HIGH:-SHA256:-SHA384

Requirements / Acceptance Criteria:

• RFC links: n/a
• Related Issues: n/a
• Will the Usage Guide or other documentation need to be updated? no
• Testing: Maybe a couple more cases in the TLS 1.2 ciphers unit tests
  • Will this change trigger AWS LibCrypto Formal Verification changes? no
  • Should this change be fuzz tested? no