TLSEXT_SIGALG_dsa_sha256,
TLSEXT_SIGALG_dsa_sha384,
- TLSEXT_SIGALG_dsa_sha512
+ TLSEXT_SIGALG_dsa_sha512,
+#endif
+#ifndef OPENSSL_NO_GOST
+ TLSEXT_SIGALG_gostr34102012_256_gostr34112012_256,
+ TLSEXT_SIGALG_gostr34102012_512_gostr34112012_512,
+ TLSEXT_SIGALG_gostr34102001_gostr3411,
#endif
};
break;
}
}
+
+ /*
+ * Some GOST ciphersuites allow more than one signature algorithms
+ * */
+ if (idx == SSL_PKEY_GOST01 && s->s3->tmp.new_cipher->algorithm_auth != SSL_aGOST01) {
+ int real_idx;
+
+ for (real_idx = SSL_PKEY_GOST12_512; real_idx >= SSL_PKEY_GOST01;
+ real_idx--) {
+ if (s->cert->pkeys[real_idx].privatekey != NULL) {
+ idx = real_idx;
+ break;
+ }
+ }
+ }
} else {
idx = s->cert->key - s->cert->pkeys;
}
const uint16_t *sent_sigs;
const EVP_MD *md = NULL;
char sigalgstr[2];
- size_t sent_sigslen, i;
+ size_t sent_sigslen, i, cidx;
int pkeyid = EVP_PKEY_id(pkey);
const SIGALG_LOOKUP *lu;
SSL_R_WRONG_SIGNATURE_TYPE);
return 0;
}
+ /* Check the sigalg is consistent with the key OID */
+ if (!ssl_cert_lookup_by_nid(EVP_PKEY_id(pkey), &cidx)
+ || lu->sig_idx != (int)cidx) {
+ SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS12_CHECK_PEER_SIGALG,
+ SSL_R_WRONG_SIGNATURE_TYPE);
+ return 0;
+ }
+
#ifndef OPENSSL_NO_EC
if (pkeyid == EVP_PKEY_EC) {
/* Some additional consistency checks */
if (slen != 0) {
SSL_SESSION_free(sess);
+ sess = NULL;
ret = SSL_TICKET_NO_DECRYPT;
goto end;
}
}
}
- switch (ret) {
- case SSL_TICKET_NO_DECRYPT:
- case SSL_TICKET_SUCCESS_RENEW:
- case SSL_TICKET_EMPTY:
- s->ext.ticket_expected = 1;
+ if (s->ext.session_secret_cb == NULL || SSL_IS_TLS13(s)) {
+ switch (ret) {
+ case SSL_TICKET_NO_DECRYPT:
+ case SSL_TICKET_SUCCESS_RENEW:
+ case SSL_TICKET_EMPTY:
+ s->ext.ticket_expected = 1;
+ }
}
*psess = sess;
|| lu->hash_idx == SSL_MD_MD5_IDX
|| lu->hash_idx == SSL_MD_SHA224_IDX))
return 0;
+
/* See if public key algorithm allowed */
if (ssl_cert_is_disabled(lu->sig_idx))
return 0;
+
+ if (lu->sig == NID_id_GostR3410_2012_256
+ || lu->sig == NID_id_GostR3410_2012_512
+ || lu->sig == NID_id_GostR3410_2001) {
+ /* We never allow GOST sig algs on the server with TLSv1.3 */
+ if (s->server && SSL_IS_TLS13(s))
+ return 0;
+ if (!s->server
+ && s->method->version == TLS_ANY_VERSION
+ && s->s3->tmp.max_ver >= TLS1_3_VERSION) {
+ int i, num;
+ STACK_OF(SSL_CIPHER) *sk;
+
+ /*
+ * We're a client that could negotiate TLSv1.3. We only allow GOST
+ * sig algs if we could negotiate TLSv1.2 or below and we have GOST
+ * ciphersuites enabled.
+ */
+
+ if (s->s3->tmp.min_ver >= TLS1_3_VERSION)
+ return 0;
+
+ sk = SSL_get_ciphers(s);
+ num = sk != NULL ? sk_SSL_CIPHER_num(sk) : 0;
+ for (i = 0; i < num; i++) {
+ const SSL_CIPHER *c;
+
+ c = sk_SSL_CIPHER_value(sk, i);
+ /* Skip disabled ciphers */
+ if (ssl_cipher_disabled(s, c, SSL_SECOP_CIPHER_SUPPORTED, 0))
+ continue;
+
+ if ((c->algorithm_mkey & SSL_kGOST) != 0)
+ break;
+ }
+ if (i == num)
+ return 0;
+ }
+ }
+
if (lu->hash == NID_undef)
return 1;
/* Security bits: half digest bits */
if (dhp == NULL)
return NULL;
g = BN_new();
- if (g != NULL)
- BN_set_word(g, 2);
+ if (g == NULL || !BN_set_word(g, 2)) {
+ DH_free(dhp);
+ BN_free(g);
+ return NULL;
+ }
if (dh_secbits >= 192)
p = BN_get_rfc3526_prime_8192(NULL);
else
p = BN_get_rfc3526_prime_3072(NULL);
- if (p == NULL || g == NULL || !DH_set0_pqg(dhp, p, NULL, g)) {
+ if (p == NULL || !DH_set0_pqg(dhp, p, NULL, g)) {
DH_free(dhp);
BN_free(p);
BN_free(g);