diff options
| author | Dmitry Belyavskiy <beldmit@gmail.com> | 2018-05-03 16:25:48 +0200 |
|---|---|---|
| committer | Matt Caswell <matt@openssl.org> | 2018-05-30 10:14:04 +0200 |
| commit | 1f65c0459a1382481f29756b85e9ec12aedaa6bf (patch) | |
| tree | 4aaf4778b99f301ed1006857501df287a0c0047b /ssl | |
| parent | Replace strdup() with OPENSSL_strdup() (diff) | |
| download | openssl-1f65c0459a1382481f29756b85e9ec12aedaa6bf.tar.xz openssl-1f65c0459a1382481f29756b85e9ec12aedaa6bf.zip | |
Bugfix: GOST2012 certificates for GOST ciphersuites were broken.
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6168)
Diffstat (limited to 'ssl')
| -rw-r--r-- | ssl/ssl_locl.h | 5 | ||||
| -rw-r--r-- | ssl/t1_lib.c | 15 |
2 files changed, 15 insertions, 5 deletions
diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h index 4aec810179..31e5cc8aa9 100644 --- a/ssl/ssl_locl.h +++ b/ssl/ssl_locl.h @@ -383,11 +383,6 @@ # define SSL_PKEY_ED25519 7 # define SSL_PKEY_ED448 8 # define SSL_PKEY_NUM 9 -/* - * Pseudo-constant. GOST cipher suites can use different certs for 1 - * SSL_CIPHER. So let's see which one we have in fact. - */ -# define SSL_PKEY_GOST_EC SSL_PKEY_NUM+1 /*- * SSL_kRSA <- RSA_ENC diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c index c076782842..e72ac73737 100644 --- a/ssl/t1_lib.c +++ b/ssl/t1_lib.c @@ -857,6 +857,21 @@ static const SIGALG_LOOKUP *tls1_get_legacy_sigalg(const SSL *s, int idx) break; } } + + /* + * Some GOST ciphersuites allow more than one signature algorithms + * */ + if (idx == SSL_PKEY_GOST01 && s->s3->tmp.new_cipher->algorithm_auth != SSL_aGOST01) { + int real_idx; + + for (real_idx = SSL_PKEY_GOST12_512; real_idx >= SSL_PKEY_GOST01; + real_idx--) { + if (s->cert->pkeys[real_idx].privatekey != NULL) { + idx = real_idx; + break; + } + } + } } else { idx = s->cert->key - s->cert->pkeys; } |