diff options
| author |   beck <beck@openbsd.org> | 2018-11-09 05:43:39 +0000 |
|---|---|---|
| committer | beck <beck@openbsd.org> | 2018-11-09 05:43:39 +0000 |
| commit | 2b3aa98db13297c368a48236668803eef4361401 (patch) | |
| tree | 5d696b1bfb910c63cc0c684d1bb18d830dfd9240 /lib/libssl | |
| parent | Delete support for obsolete BSS PLT format, which was last known to be (diff) | |
| download | wireguard-openbsd-2b3aa98db13297c368a48236668803eef4361401.tar.xz wireguard-openbsd-2b3aa98db13297c368a48236668803eef4361401.zip | |
Ensure we only choose sigalgs from our prefernce list, not the whole list
ok jsing@
Diffstat (limited to 'lib/libssl')
| -rw-r--r-- | lib/libssl/ssl_clnt.c | 5 | ||||
| -rw-r--r-- | lib/libssl/ssl_sigalgs.c | 15 | ||||
| -rw-r--r-- | lib/libssl/ssl_sigalgs.h | 4 | ||||
| -rw-r--r-- | lib/libssl/ssl_srvr.c | 5 |
4 files changed, 19 insertions, 10 deletions
diff --git a/lib/libssl/ssl_clnt.c b/lib/libssl/ssl_clnt.c index f1b3d40e7ce..5dbda1f2fa7 100644 --- a/lib/libssl/ssl_clnt.c +++ b/lib/libssl/ssl_clnt.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssl_clnt.c,v 1.38 2018/11/09 00:34:55 beck Exp $ */ +/* $OpenBSD: ssl_clnt.c,v 1.39 2018/11/09 05:43:39 beck Exp $ */ /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) * All rights reserved. * @@ -1510,7 +1510,8 @@ ssl3_get_server_key_exchange(SSL *s) if (!CBS_get_u16(&cbs, &sigalg)) goto truncated; - if ((md = ssl_sigalg_md(sigalg)) == NULL) { + if ((md = ssl_sigalg_md(sigalg, tls12_sigalgs, + tls12_sigalgs_len)) == NULL) { SSLerror(s, SSL_R_UNKNOWN_DIGEST); al = SSL_AD_DECODE_ERROR; goto f_err; diff --git a/lib/libssl/ssl_sigalgs.c b/lib/libssl/ssl_sigalgs.c index fe10965feb3..3f82117dcf0 100644 --- a/lib/libssl/ssl_sigalgs.c +++ b/lib/libssl/ssl_sigalgs.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssl_sigalgs.c,v 1.2 2018/11/09 05:02:53 beck Exp $ */ +/* $OpenBSD: ssl_sigalgs.c,v 1.3 2018/11/09 05:43:39 beck Exp $ */ /* * Copyright (c) 2018, Bob Beck <beck@openbsd.org> * @@ -188,12 +188,19 @@ ssl_sigalg_lookup(uint16_t sigalg) } const EVP_MD * -ssl_sigalg_md(uint16_t sigalg) +ssl_sigalg_md(uint16_t sigalg, uint16_t *values, size_t len) { const struct ssl_sigalg *sap; + int i; - if ((sap = ssl_sigalg_lookup(sigalg)) != NULL) - return sap->md(); + for (i = 0; i < len; i++) { + if (values[i] == sigalg) + break; + } + if (values[i] == sigalg) { + if ((sap = ssl_sigalg_lookup(sigalg)) != NULL) + return sap->md(); + } return NULL; } diff --git a/lib/libssl/ssl_sigalgs.h b/lib/libssl/ssl_sigalgs.h index 629213e7614..3839a8d37cb 100644 --- a/lib/libssl/ssl_sigalgs.h +++ b/lib/libssl/ssl_sigalgs.h @@ -1,4 +1,4 @@ -/* $OpenBSD: ssl_sigalgs.h,v 1.3 2018/11/09 05:02:53 beck Exp $ */ +/* $OpenBSD: ssl_sigalgs.h,v 1.4 2018/11/09 05:43:39 beck Exp $ */ /* * Copyright (c) 2018, Bob Beck <beck@openbsd.org> * @@ -70,7 +70,7 @@ extern uint16_t tls12_sigalgs[]; extern size_t tls12_sigalgs_len; const struct ssl_sigalg *ssl_sigalg_lookup(uint16_t sigalg); -const EVP_MD * ssl_sigalg_md(uint16_t sigalg); +const EVP_MD * ssl_sigalg_md(uint16_t sigalg, uint16_t *values, size_t len); uint16_t ssl_sigalg_value(const EVP_PKEY *pk, const EVP_MD *md); int ssl_sigalgs_build(CBB *cbb, uint16_t *values, size_t len); int ssl_sigalg_pkey_check(uint16_t sigalg, EVP_PKEY *pk); diff --git a/lib/libssl/ssl_srvr.c b/lib/libssl/ssl_srvr.c index 59d560d06da..51e5475f54d 100644 --- a/lib/libssl/ssl_srvr.c +++ b/lib/libssl/ssl_srvr.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssl_srvr.c,v 1.53 2018/11/09 05:02:53 beck Exp $ */ +/* $OpenBSD: ssl_srvr.c,v 1.54 2018/11/09 05:43:39 beck Exp $ */ /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) * All rights reserved. * @@ -2159,7 +2159,8 @@ ssl3_get_cert_verify(SSL *s) if (!CBS_get_u16(&cbs, &sigalg)) goto truncated; - if ((md = ssl_sigalg_md(sigalg)) == NULL) { + if ((md = ssl_sigalg_md(sigalg, tls12_sigalgs, + tls12_sigalgs_len)) == NULL) { SSLerror(s, SSL_R_UNKNOWN_DIGEST); al = SSL_AD_DECODE_ERROR; goto f_err; |