aboutsummaryrefslogtreecommitdiff
path: root/openssl/ssl/ssl_lib.c
diff options
context:
space:
mode:
authormarha <marha@users.sourceforge.net>2011-09-30 08:40:25 +0200
committermarha <marha@users.sourceforge.net>2011-09-30 08:40:25 +0200
commit60adbfdea1ee754341d64454274e7aa83bae8971 (patch)
tree1b56329c88f1a881b0e7297bb4283cfbb7e39c97 /openssl/ssl/ssl_lib.c
parentaf72dcd109d7610b96863035541250997c7a172e (diff)
downloadvcxsrv-60adbfdea1ee754341d64454274e7aa83bae8971.tar.gz
vcxsrv-60adbfdea1ee754341d64454274e7aa83bae8971.tar.bz2
vcxsrv-60adbfdea1ee754341d64454274e7aa83bae8971.zip
Upgraded to openssl-1.0.0e
Diffstat (limited to 'openssl/ssl/ssl_lib.c')
-rw-r--r--openssl/ssl/ssl_lib.c32
1 files changed, 13 insertions, 19 deletions
diff --git a/openssl/ssl/ssl_lib.c b/openssl/ssl/ssl_lib.c
index 912592b8b..46732791f 100644
--- a/openssl/ssl/ssl_lib.c
+++ b/openssl/ssl/ssl_lib.c
@@ -1833,7 +1833,7 @@ void ssl_set_cert_masks(CERT *c, const SSL_CIPHER *cipher)
#endif
X509 *x = NULL;
EVP_PKEY *ecc_pkey = NULL;
- int signature_nid = 0;
+ int signature_nid = 0, pk_nid = 0, md_nid = 0;
if (c == NULL) return;
@@ -1963,18 +1963,15 @@ void ssl_set_cert_masks(CERT *c, const SSL_CIPHER *cipher)
EVP_PKEY_bits(ecc_pkey) : 0;
EVP_PKEY_free(ecc_pkey);
if ((x->sig_alg) && (x->sig_alg->algorithm))
+ {
signature_nid = OBJ_obj2nid(x->sig_alg->algorithm);
+ OBJ_find_sigid_algs(signature_nid, &md_nid, &pk_nid);
+ }
#ifndef OPENSSL_NO_ECDH
if (ecdh_ok)
{
- const char *sig = OBJ_nid2ln(signature_nid);
- if (sig == NULL)
- {
- ERR_clear_error();
- sig = "unknown";
- }
-
- if (strstr(sig, "WithRSA"))
+
+ if (pk_nid == NID_rsaEncryption || pk_nid == NID_rsa)
{
mask_k|=SSL_kECDHr;
mask_a|=SSL_aECDH;
@@ -1985,7 +1982,7 @@ void ssl_set_cert_masks(CERT *c, const SSL_CIPHER *cipher)
}
}
- if (signature_nid == NID_ecdsa_with_SHA1)
+ if (pk_nid == NID_X9_62_id_ecPublicKey)
{
mask_k|=SSL_kECDHe;
mask_a|=SSL_aECDH;
@@ -2039,7 +2036,7 @@ int ssl_check_srvr_ecc_cert_and_alg(X509 *x, const SSL_CIPHER *cs)
unsigned long alg_k, alg_a;
EVP_PKEY *pkey = NULL;
int keysize = 0;
- int signature_nid = 0;
+ int signature_nid = 0, md_nid = 0, pk_nid = 0;
alg_k = cs->algorithm_mkey;
alg_a = cs->algorithm_auth;
@@ -2057,7 +2054,10 @@ int ssl_check_srvr_ecc_cert_and_alg(X509 *x, const SSL_CIPHER *cs)
/* This call populates the ex_flags field correctly */
X509_check_purpose(x, -1, 0);
if ((x->sig_alg) && (x->sig_alg->algorithm))
+ {
signature_nid = OBJ_obj2nid(x->sig_alg->algorithm);
+ OBJ_find_sigid_algs(signature_nid, &md_nid, &pk_nid);
+ }
if (alg_k & SSL_kECDHe || alg_k & SSL_kECDHr)
{
/* key usage, if present, must allow key agreement */
@@ -2069,7 +2069,7 @@ int ssl_check_srvr_ecc_cert_and_alg(X509 *x, const SSL_CIPHER *cs)
if (alg_k & SSL_kECDHe)
{
/* signature alg must be ECDSA */
- if (signature_nid != NID_ecdsa_with_SHA1)
+ if (pk_nid != NID_X9_62_id_ecPublicKey)
{
SSLerr(SSL_F_SSL_CHECK_SRVR_ECC_CERT_AND_ALG, SSL_R_ECC_CERT_SHOULD_HAVE_SHA1_SIGNATURE);
return 0;
@@ -2079,13 +2079,7 @@ int ssl_check_srvr_ecc_cert_and_alg(X509 *x, const SSL_CIPHER *cs)
{
/* signature alg must be RSA */
- const char *sig = OBJ_nid2ln(signature_nid);
- if (sig == NULL)
- {
- ERR_clear_error();
- sig = "unknown";
- }
- if (strstr(sig, "WithRSA") == NULL)
+ if (pk_nid != NID_rsaEncryption && pk_nid != NID_rsa)
{
SSLerr(SSL_F_SSL_CHECK_SRVR_ECC_CERT_AND_ALG, SSL_R_ECC_CERT_SHOULD_HAVE_RSA_SIGNATURE);
return 0;