From d87ea3e4e43b8fc3e2ccf707627a9702182dae4d Mon Sep 17 00:00:00 2001 From: Hakase Date: Wed, 25 Apr 2018 22:13:22 +0900 Subject: [PATCH] New Patch --- ssl/s3_lib.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c index b11285cf..28957292 100644 --- a/ssl/s3_lib.c +++ b/ssl/s3_lib.c @@ -4200,11 +4200,15 @@ const SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt, s->version != DTLS1_VERSION)) ok = 0; - /* not use ECDSA under TLS v1.2 */ - // if ((alg_a & SSL_aECDSA) && s->version != TLS1_2_VERSION) ok = 0; - if ((alg_a & SSL_aRSA) && + /* Skip SHA(SHA1) cipher over TLS v1.2 */ + if (s->version == TLS1_2_VERSION && + c->algorithm_mac & SSL_SHA1) + ok = 0; + + /* Not use weak cipher after TLSv1.0 */ + if ((alg_a & SSL_aRSA) && (alg_k & SSL_kRSA) && - (s->version != TLS1_VERSION)) ok = 0; + (s->version != TLS1_VERSION)) ok = 0; #ifndef OPENSSL_NO_PSK /* with PSK there must be server callback set */