Modify sigalgs extension processing for TLS 1.3.

- Make a separate sigalgs list for TLS 1.3 including only modern
  algorithm choices which we use when the handshake will not negotiate
  TLS 1.2
- Modify the legacy sigalgs for TLS 1.2 to include the RSA PSS algorithms as
  mandated by RFC8446 when the handshake will permit negotiation of TLS 1.2
ok jsing@ tb@

1 files changed, 7 insertions, 1 deletions

diff --git a/src/lib/libssl/s3_lib.c b/src/lib/libssl/s3_lib.c
index 9e4998cb42..53aab7c1e5 100644
--- a/src/lib/libssl/s3_lib.c
+++ b/src/lib/libssl/s3_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: s3_lib.c,v 1.178 2019/01/21 01:20:11 jsing Exp $ */
+/* $OpenBSD: s3_lib.c,v 1.179 2019/01/23 16:46:04 beck Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -1569,6 +1569,7 @@ ssl3_free(SSL *s)
         freezero(S3I(s)->hs_tls13.x25519_private, X25519_KEY_LENGTH);
         freezero(S3I(s)->hs_tls13.x25519_public, X25519_KEY_LENGTH);
         freezero(S3I(s)->hs_tls13.x25519_peer_public, X25519_KEY_LENGTH);
+        freezero(S3I(s)->hs_tls13.cookie, S3I(s)->hs_tls13.cookie_len);
 
         sk_X509_NAME_pop_free(S3I(s)->tmp.ca_names, X509_NAME_free);
 
@@ -1605,6 +1606,11 @@ ssl3_clear(SSL *s)
         freezero(S3I(s)->hs_tls13.x25519_private, X25519_KEY_LENGTH);
         freezero(S3I(s)->hs_tls13.x25519_public, X25519_KEY_LENGTH);
         freezero(S3I(s)->hs_tls13.x25519_peer_public, X25519_KEY_LENGTH);
+        freezero(S3I(s)->hs_tls13.cookie, S3I(s)->hs_tls13.cookie_len);
+        S3I(s)->hs_tls13.cookie = NULL;
+        S3I(s)->hs_tls13.cookie_len = 0;
+
+        S3I(s)->hs.extensions_seen = 0;
 
         rp = S3I(s)->rbuf.buf;
         wp = S3I(s)->wbuf.buf;