summaryrefslogtreecommitdiff
path: root/src/lib/libssl/ssl_clnt.c
diff options
context:
space:
mode:
authorbeck <>2019-01-23 16:46:04 +0000
committerbeck <>2019-01-23 16:46:04 +0000
commit811354ae1302b7cd68c86866b02f4ab4cf11322b (patch)
treeb41a9c3ad5801c2f161aede880a9a198b66706f7 /src/lib/libssl/ssl_clnt.c
parent37392584e512230f90ecbecb535ed1ac0bedd0af (diff)
downloadopenbsd-811354ae1302b7cd68c86866b02f4ab4cf11322b.tar.gz
openbsd-811354ae1302b7cd68c86866b02f4ab4cf11322b.tar.bz2
openbsd-811354ae1302b7cd68c86866b02f4ab4cf11322b.zip
Modify sigalgs extension processing for TLS 1.3.
- Make a separate sigalgs list for TLS 1.3 including only modern algorithm choices which we use when the handshake will not negotiate TLS 1.2 - Modify the legacy sigalgs for TLS 1.2 to include the RSA PSS algorithms as mandated by RFC8446 when the handshake will permit negotiation of TLS 1.2 ok jsing@ tb@
Diffstat (limited to 'src/lib/libssl/ssl_clnt.c')
-rw-r--r--src/lib/libssl/ssl_clnt.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/src/lib/libssl/ssl_clnt.c b/src/lib/libssl/ssl_clnt.c
index acc48389c0..ee26a200b1 100644
--- a/src/lib/libssl/ssl_clnt.c
+++ b/src/lib/libssl/ssl_clnt.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ssl_clnt.c,v 1.52 2019/01/18 00:54:42 jsing Exp $ */ 1/* $OpenBSD: ssl_clnt.c,v 1.53 2019/01/23 16:46:04 beck Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved. 3 * All rights reserved.
4 * 4 *
@@ -1680,7 +1680,8 @@ ssl3_get_certificate_request(SSL *s)
1680 SSLerror(s, SSL_R_DATA_LENGTH_TOO_LONG); 1680 SSLerror(s, SSL_R_DATA_LENGTH_TOO_LONG);
1681 goto err; 1681 goto err;
1682 } 1682 }
1683 if (!tls1_process_sigalgs(s, &sigalgs)) { 1683 if (!tls1_process_sigalgs(s, &sigalgs, tls12_sigalgs,
1684 tls12_sigalgs_len)) {
1684 ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); 1685 ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR);
1685 SSLerror(s, SSL_R_SIGNATURE_ALGORITHMS_ERROR); 1686 SSLerror(s, SSL_R_SIGNATURE_ALGORITHMS_ERROR);
1686 goto err; 1687 goto err;