diff options
author | beck <> | 2019-01-23 16:46:04 +0000 |
---|---|---|
committer | beck <> | 2019-01-23 16:46:04 +0000 |
commit | 811354ae1302b7cd68c86866b02f4ab4cf11322b (patch) | |
tree | b41a9c3ad5801c2f161aede880a9a198b66706f7 /src/lib/libssl/ssl_clnt.c | |
parent | 37392584e512230f90ecbecb535ed1ac0bedd0af (diff) | |
download | openbsd-811354ae1302b7cd68c86866b02f4ab4cf11322b.tar.gz openbsd-811354ae1302b7cd68c86866b02f4ab4cf11322b.tar.bz2 openbsd-811354ae1302b7cd68c86866b02f4ab4cf11322b.zip |
Modify sigalgs extension processing for TLS 1.3.
- Make a separate sigalgs list for TLS 1.3 including only modern
algorithm choices which we use when the handshake will not negotiate
TLS 1.2
- Modify the legacy sigalgs for TLS 1.2 to include the RSA PSS algorithms as
mandated by RFC8446 when the handshake will permit negotiation of TLS 1.2
ok jsing@ tb@
Diffstat (limited to 'src/lib/libssl/ssl_clnt.c')
-rw-r--r-- | src/lib/libssl/ssl_clnt.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/src/lib/libssl/ssl_clnt.c b/src/lib/libssl/ssl_clnt.c index acc48389c0..ee26a200b1 100644 --- a/src/lib/libssl/ssl_clnt.c +++ b/src/lib/libssl/ssl_clnt.c | |||
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: ssl_clnt.c,v 1.52 2019/01/18 00:54:42 jsing Exp $ */ | 1 | /* $OpenBSD: ssl_clnt.c,v 1.53 2019/01/23 16:46:04 beck Exp $ */ |
2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) |
3 | * All rights reserved. | 3 | * All rights reserved. |
4 | * | 4 | * |
@@ -1680,7 +1680,8 @@ ssl3_get_certificate_request(SSL *s) | |||
1680 | SSLerror(s, SSL_R_DATA_LENGTH_TOO_LONG); | 1680 | SSLerror(s, SSL_R_DATA_LENGTH_TOO_LONG); |
1681 | goto err; | 1681 | goto err; |
1682 | } | 1682 | } |
1683 | if (!tls1_process_sigalgs(s, &sigalgs)) { | 1683 | if (!tls1_process_sigalgs(s, &sigalgs, tls12_sigalgs, |
1684 | tls12_sigalgs_len)) { | ||
1684 | ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); | 1685 | ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); |
1685 | SSLerror(s, SSL_R_SIGNATURE_ALGORITHMS_ERROR); | 1686 | SSLerror(s, SSL_R_SIGNATURE_ALGORITHMS_ERROR); |
1686 | goto err; | 1687 | goto err; |