Hakase/openssl-custom
1
0 Fork 0
Code Issues Pull Requests Releases Wiki Activity

Latest update

Browse Source
This commit is contained in:
Hakase
2018-11-11 15:42:06 +09:00
parent 89e3b2d5aa
commit d9b6665b74
41 changed files with 414 additions and 209 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ssl/t1_lib.c
+34 -10
View File
@@ -343,6 +343,10 @@ int tls1_set_groups(uint16_t **pext, size_t *pextlen,
*/
unsigned long dup_list = 0;
if (ngroups == 0) {
SSLerr(SSL_F_TLS1_SET_GROUPS, SSL_R_BAD_LENGTH);
return 0;
}
if ((glist = OPENSSL_malloc(ngroups * sizeof(*glist))) == NULL) {
SSLerr(SSL_F_TLS1_SET_GROUPS, ERR_R_MALLOC_FAILURE);
return 0;
@@ -2492,7 +2496,7 @@ static int tls12_get_cert_sigalg_idx(const SSL *s, const SIGALG_LOOKUP *lu)
static int has_usable_cert(SSL *s, const SIGALG_LOOKUP *sig, int idx)
{
const SIGALG_LOOKUP *lu;
int mdnid, pknid;
int mdnid, pknid, supported;
size_t i;
/* TLS 1.2 callers can override lu->sig_idx, but not TLS 1.3 callers. */
@@ -2505,19 +2509,39 @@ static int has_usable_cert(SSL *s, const SIGALG_LOOKUP *sig, int idx)
lu = tls1_lookup_sigalg(s->s3->tmp.peer_cert_sigalgs[i]);
if (lu == NULL
|| !X509_get_signature_info(s->cert->pkeys[idx].x509, &mdnid,
&pknid, NULL, NULL))
&pknid, NULL, NULL)
/*
* TODO this does not differentiate between the
* rsa_pss_pss_* and rsa_pss_rsae_* schemes since we do not
* have a chain here that lets us look at the key OID in the
* signing certificate.
*/
|| mdnid != lu->hash
|| pknid != lu->sig)
continue;
/*
* TODO this does not differentiate between the
* rsa_pss_pss_* and rsa_pss_rsae_* schemes since we do not
* have a chain here that lets us look at the key OID in the
* signing certificate.
*/
if (mdnid == lu->hash && pknid == lu->sig)
return 1;
ERR_set_mark();
supported = EVP_PKEY_supports_digest_nid(s->cert->pkeys[idx].privatekey,
mdnid);
if (supported == 0)
continue;
else if (supported < 0)
{
/* If it didn't report a mandatory NID, for whatever reasons,
* just clear the error and allow all hashes to be used. */
ERR_pop_to_mark();
}
return 1;
}
return 0;
}
supported = EVP_PKEY_supports_digest_nid(s->cert->pkeys[idx].privatekey,
sig->hash);
if (supported == 0)
return 0;
else if (supported < 0)
ERR_clear_error();
return 1;
}