1 files changed, 15 insertions, 32 deletions

diff --git a/src/lib/libssl/ssl_lib.c b/src/lib/libssl/ssl_lib.c
index 497515f9ec..a3c9309488 100644
--- a/src/lib/libssl/ssl_lib.c
+++ b/src/lib/libssl/ssl_lib.c
@@ -1830,7 +1830,7 @@ void ssl_set_cert_masks(CERT *c, const SSL_CIPHER *cipher)
 #endif
         X509 *x = NULL;
         EVP_PKEY *ecc_pkey = NULL;
-        int signature_nid = 0;
+        int signature_nid = 0, pk_nid = 0, md_nid = 0;
 
         if (c == NULL) return;
 
@@ -1960,18 +1960,15 @@ void ssl_set_cert_masks(CERT *c, const SSL_CIPHER *cipher)
                     EVP_PKEY_bits(ecc_pkey) : 0;
                 EVP_PKEY_free(ecc_pkey);
                 if ((x->sig_alg) && (x->sig_alg->algorithm))
+                        {
                         signature_nid = OBJ_obj2nid(x->sig_alg->algorithm);
+                        OBJ_find_sigid_algs(signature_nid, &md_nid, &pk_nid);
+                        }
 #ifndef OPENSSL_NO_ECDH
                 if (ecdh_ok)
                         {
-                        const char *sig = OBJ_nid2ln(signature_nid);
-                        if (sig == NULL)
-                                {
-                                ERR_clear_error();
-                                sig = "unknown";
-                                }
-                                
-                        if (strstr(sig, "WithRSA"))
+
+                        if (pk_nid == NID_rsaEncryption || pk_nid == NID_rsa)
                                 {
                                 mask_k|=SSL_kECDHr;
                                 mask_a|=SSL_aECDH;
@@ -1982,7 +1979,7 @@ void ssl_set_cert_masks(CERT *c, const SSL_CIPHER *cipher)
                                         }
                                 }
 
-                        if (signature_nid == NID_ecdsa_with_SHA1)
+                        if (pk_nid == NID_X9_62_id_ecPublicKey)
                                 {
                                 mask_k|=SSL_kECDHe;
                                 mask_a|=SSL_aECDH;
@@ -2036,7 +2033,7 @@ int ssl_check_srvr_ecc_cert_and_alg(X509 *x, const SSL_CIPHER *cs)
         unsigned long alg_k, alg_a;
         EVP_PKEY *pkey = NULL;
         int keysize = 0;
-        int signature_nid = 0;
+        int signature_nid = 0, md_nid = 0, pk_nid = 0;
 
         alg_k = cs->algorithm_mkey;
         alg_a = cs->algorithm_auth;
@@ -2054,7 +2051,10 @@ int ssl_check_srvr_ecc_cert_and_alg(X509 *x, const SSL_CIPHER *cs)
         /* This call populates the ex_flags field correctly */
         X509_check_purpose(x, -1, 0);
         if ((x->sig_alg) && (x->sig_alg->algorithm))
+                {
                 signature_nid = OBJ_obj2nid(x->sig_alg->algorithm);
+                OBJ_find_sigid_algs(signature_nid, &md_nid, &pk_nid);
+                }
         if (alg_k & SSL_kECDHe || alg_k & SSL_kECDHr)
                 {
                 /* key usage, if present, must allow key agreement */
@@ -2066,7 +2066,7 @@ int ssl_check_srvr_ecc_cert_and_alg(X509 *x, const SSL_CIPHER *cs)
                 if (alg_k & SSL_kECDHe)
                         {
                         /* signature alg must be ECDSA */
-                        if (signature_nid != NID_ecdsa_with_SHA1)
+                        if (pk_nid != NID_X9_62_id_ecPublicKey)
                                 {
                                 SSLerr(SSL_F_SSL_CHECK_SRVR_ECC_CERT_AND_ALG, SSL_R_ECC_CERT_SHOULD_HAVE_SHA1_SIGNATURE);
                                 return 0;
@@ -2076,13 +2076,7 @@ int ssl_check_srvr_ecc_cert_and_alg(X509 *x, const SSL_CIPHER *cs)
                         {
                         /* signature alg must be RSA */
 
-                        const char *sig = OBJ_nid2ln(signature_nid);
-                        if (sig == NULL)
-                                {
-                                ERR_clear_error();
-                                sig = "unknown";
-                                }
-                        if (strstr(sig, "WithRSA") == NULL)
+                        if (pk_nid != NID_rsaEncryption && pk_nid != NID_rsa)
                                 {
                                 SSLerr(SSL_F_SSL_CHECK_SRVR_ECC_CERT_AND_ALG, SSL_R_ECC_CERT_SHOULD_HAVE_RSA_SIGNATURE);
                                 return 0;
@@ -2107,23 +2101,12 @@ int ssl_check_srvr_ecc_cert_and_alg(X509 *x, const SSL_CIPHER *cs)
 /* THIS NEEDS CLEANING UP */
 X509 *ssl_get_server_send_cert(SSL *s)
         {
-        unsigned long alg_k,alg_a,mask_k,mask_a;
+        unsigned long alg_k,alg_a;
         CERT *c;
-        int i,is_export;
+        int i;
 
         c=s->cert;
         ssl_set_cert_masks(c, s->s3->tmp.new_cipher);
-        is_export=SSL_C_IS_EXPORT(s->s3->tmp.new_cipher);
-        if (is_export)
-                {
-                mask_k = c->export_mask_k;
-                mask_a = c->export_mask_a;
-                }
-        else
-                {
-                mask_k = c->mask_k;
-                mask_a = c->mask_a;
-                }
         
         alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
         alg_a = s->s3->tmp.new_cipher->algorithm_auth;