diff options
| author | Dmitry Belyavskiy <beldmit@gmail.com> | 2020-03-30 18:09:24 +0300 |
|---|---|---|
| committer | Dmitry Belyavskiy <beldmit@gmail.com> | 2020-05-19 13:02:43 +0300 |
| commit | 5a5530a29abcf5d7ab7194d73b3807d568b06cbd (patch) | |
| tree | 4084ebfee1f5e052d892e6b406c5b9358920170c /ssl/t1_lib.c | |
| parent | 0e139a02d59323e5d9c0ad87ea9c8c3914696b83 (diff) | |
New Russian TLS 1.2 implementation
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11442)
Diffstat (limited to 'ssl/t1_lib.c')
| -rw-r--r-- | ssl/t1_lib.c | 17 |
1 files changed, 16 insertions, 1 deletions
diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c index 416ba28fb6..f3373dc6d5 100644 --- a/ssl/t1_lib.c +++ b/ssl/t1_lib.c @@ -1001,6 +1001,21 @@ static const SIGALG_LOOKUP *tls1_get_legacy_sigalg(const SSL *s, int idx) } } } + /* + * As both SSL_PKEY_GOST12_512 and SSL_PKEY_GOST12_256 indices can be used + * with new (aGOST12-only) ciphersuites, we should find out which one is available really. + */ + else if (idx == SSL_PKEY_GOST12_256) { + int real_idx; + + for (real_idx = SSL_PKEY_GOST12_512; real_idx >= SSL_PKEY_GOST12_256; + real_idx--) { + if (s->cert->pkeys[real_idx].privatekey != NULL) { + idx = real_idx; + break; + } + } + } } else { idx = s->cert->key - s->cert->pkeys; } @@ -1794,7 +1809,7 @@ static int tls12_sigalg_allowed(const SSL *s, int op, const SIGALG_LOOKUP *lu) if (ssl_cipher_disabled(s, c, SSL_SECOP_CIPHER_SUPPORTED, 0)) continue; - if ((c->algorithm_mkey & SSL_kGOST) != 0) + if ((c->algorithm_mkey & (SSL_kGOST | SSL_kGOST18)) != 0) break; } if (i == num) |