wbrawner/openssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

remove md array: it is not used any more.

Browse source 
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2679)
This commit is contained in:
Dr. Stephen Henson 2017-02-18 03:42:15 +00:00
parent 5e1f879ab5
commit 9195ddcd0f
3 changed files with 27 additions and 107 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
ssl/ssl_locl.h
View file

@ -1320,8 +1320,6 @@ typedef struct ssl3_state_st {
size_t peer_sigalgslen; size_t peer_sigalgslen;
/* Sigalg peer actualy uses */ /* Sigalg peer actualy uses */
const SIGALG_LOOKUP *peer_sigalg; const SIGALG_LOOKUP *peer_sigalg;
/* Array of digests used for signing */
const EVP_MD *md[SSL_PKEY_NUM];
/* /*
* Set if corresponding CERT_PKEY can be used with current * Set if corresponding CERT_PKEY can be used with current
* SSL session: e.g. appropriate curve, signature algorithms etc. * SSL session: e.g. appropriate curve, signature algorithms etc.

8
ssl/statem/statem_clnt.c
View file

@ -2240,11 +2240,9 @@ MSG_PROCESS_RETURN tls_process_certificate_request(SSL *s, PACKET *pkt)
goto err; goto err;
} }
/* Clear certificate digests and validity flags */ /* Clear certificate validity flags */
for (i = 0; i < SSL_PKEY_NUM; i++) { for (i = 0; i < SSL_PKEY_NUM; i++)
s->s3->tmp.md[i] = NULL;
s->s3->tmp.valid_flags[i] = 0; s->s3->tmp.valid_flags[i] = 0;
}
if (!tls1_save_sigalgs(s, &sigalgs)) { if (!tls1_save_sigalgs(s, &sigalgs)) {
ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR);
SSLerr(SSL_F_TLS_PROCESS_CERTIFICATE_REQUEST, SSLerr(SSL_F_TLS_PROCESS_CERTIFICATE_REQUEST,
@ -2256,8 +2254,6 @@ MSG_PROCESS_RETURN tls_process_certificate_request(SSL *s, PACKET *pkt)
SSLerr(SSL_F_TLS_PROCESS_CERTIFICATE_REQUEST, ERR_R_MALLOC_FAILURE); SSLerr(SSL_F_TLS_PROCESS_CERTIFICATE_REQUEST, ERR_R_MALLOC_FAILURE);
goto err; goto err;
} }
} else {
ssl_set_default_md(s);
} }
/* get the CA RDNs */ /* get the CA RDNs */

124
ssl/t1_lib.c
View file

@ -568,7 +568,7 @@ void tls1_get_formatlist(SSL *s, const unsigned char **pformats,
* Check cert parameters compatible with extensions: currently just checks EC * Check cert parameters compatible with extensions: currently just checks EC
* certificates have compatible curves and compression. * certificates have compatible curves and compression.
*/ */
static int tls1_check_cert_param(SSL *s, X509 *x, int set_ee_md) static int tls1_check_cert_param(SSL *s, X509 *x, int check_ee_md)
{ {
unsigned char comp_id, curve_id[2]; unsigned char comp_id, curve_id[2];
EVP_PKEY *pkey; EVP_PKEY *pkey;
@ -591,9 +591,9 @@ static int tls1_check_cert_param(SSL *s, X509 *x, int set_ee_md)
return 0; return 0;
/* /*
* Special case for suite B. We *MUST* sign using SHA256+P-256 or * Special case for suite B. We *MUST* sign using SHA256+P-256 or
* SHA384+P-384, adjust digest if necessary. * SHA384+P-384.
*/ */
if (set_ee_md && tls1_suiteb(s)) { if (check_ee_md && tls1_suiteb(s)) {
int check_md; int check_md;
size_t i; size_t i;
CERT *c = s->cert; CERT *c = s->cert;
@ -611,12 +611,6 @@ static int tls1_check_cert_param(SSL *s, X509 *x, int set_ee_md)
break; break;
if (i == c->shared_sigalgslen) if (i == c->shared_sigalgslen)
return 0; return 0;
if (set_ee_md == 2) {
if (check_md == NID_ecdsa_with_SHA256)
s->s3->tmp.md[SSL_PKEY_ECC] = EVP_sha256();
else
s->s3->tmp.md[SSL_PKEY_ECC] = EVP_sha384();
}
} }
return rv; return rv;
} }
@ -1069,29 +1063,6 @@ int tls_use_ticket(SSL *s)
return ssl_security(s, SSL_SECOP_TICKET, 0, 0, NULL); return ssl_security(s, SSL_SECOP_TICKET, 0, 0, NULL);
} }
/* Initialise digests to default values */
void ssl_set_default_md(SSL *s)
{
const EVP_MD **pmd = s->s3->tmp.md;
#ifndef OPENSSL_NO_DSA
pmd[SSL_PKEY_DSA_SIGN] = ssl_md(SSL_MD_SHA1_IDX);
#endif
#ifndef OPENSSL_NO_RSA
if (SSL_USE_SIGALGS(s))
pmd[SSL_PKEY_RSA] = ssl_md(SSL_MD_SHA1_IDX);
else
pmd[SSL_PKEY_RSA] = ssl_md(SSL_MD_MD5_SHA1_IDX);
#endif
#ifndef OPENSSL_NO_EC
pmd[SSL_PKEY_ECC] = ssl_md(SSL_MD_SHA1_IDX);
#endif
#ifndef OPENSSL_NO_GOST
pmd[SSL_PKEY_GOST01] = ssl_md(SSL_MD_GOST94_IDX);
pmd[SSL_PKEY_GOST12_256] = ssl_md(SSL_MD_GOST12_256_IDX);
pmd[SSL_PKEY_GOST12_512] = ssl_md(SSL_MD_GOST12_512_IDX);
#endif
}
int tls1_set_server_sigalgs(SSL *s) int tls1_set_server_sigalgs(SSL *s)
{ {
int al; int al;
@ -1101,30 +1072,23 @@ int tls1_set_server_sigalgs(SSL *s)
OPENSSL_free(s->cert->shared_sigalgs); OPENSSL_free(s->cert->shared_sigalgs);
s->cert->shared_sigalgs = NULL; s->cert->shared_sigalgs = NULL;
s->cert->shared_sigalgslen = 0; s->cert->shared_sigalgslen = 0;
/* Clear certificate digests and validity flags */ /* Clear certificate validity flags */
for (i = 0; i < SSL_PKEY_NUM; i++) { for (i = 0; i < SSL_PKEY_NUM; i++)
s->s3->tmp.md[i] = NULL;
s->s3->tmp.valid_flags[i] = 0; s->s3->tmp.valid_flags[i] = 0;
}
/* If sigalgs received process it. */ if (s->s3->tmp.peer_sigalgs == NULL)
if (s->s3->tmp.peer_sigalgs) { return 1;
if (!tls1_process_sigalgs(s)) {
SSLerr(SSL_F_TLS1_SET_SERVER_SIGALGS, ERR_R_MALLOC_FAILURE); if (!tls1_process_sigalgs(s)) {
al = SSL_AD_INTERNAL_ERROR; SSLerr(SSL_F_TLS1_SET_SERVER_SIGALGS, ERR_R_MALLOC_FAILURE);
goto err; al = SSL_AD_INTERNAL_ERROR;
} goto err;
/* Fatal error is no shared signature algorithms */
if (!s->cert->shared_sigalgs) {
SSLerr(SSL_F_TLS1_SET_SERVER_SIGALGS,
SSL_R_NO_SHARED_SIGNATURE_ALGORITHMS);
al = SSL_AD_ILLEGAL_PARAMETER;
goto err;
}
} else {
ssl_set_default_md(s);
} }
return 1; if (s->cert->shared_sigalgs != NULL)
return 1;
/* Fatal error is no shared signature algorithms */
SSLerr(SSL_F_TLS1_SET_SERVER_SIGALGS, SSL_R_NO_SHARED_SIGNATURE_ALGORITHMS);
al = SSL_AD_ILLEGAL_PARAMETER;
err: err:
ssl3_send_alert(s, SSL3_AL_FATAL, al); ssl3_send_alert(s, SSL3_AL_FATAL, al);
return 0; return 0;
@ -1587,62 +1551,26 @@ int tls1_save_sigalgs(SSL *s, PACKET *pkt)
int tls1_process_sigalgs(SSL *s) int tls1_process_sigalgs(SSL *s)
{ {
int idx;
size_t i; size_t i;
const EVP_MD *md;
const EVP_MD **pmd = s->s3->tmp.md;
uint32_t *pvalid = s->s3->tmp.valid_flags; uint32_t *pvalid = s->s3->tmp.valid_flags;
CERT *c = s->cert; CERT *c = s->cert;
if (!tls1_set_shared_sigalgs(s)) if (!tls1_set_shared_sigalgs(s))
return 0; return 0;
for (i = 0; i < SSL_PKEY_NUM; i++)
pvalid[i] = 0;
for (i = 0; i < c->shared_sigalgslen; i++) { for (i = 0; i < c->shared_sigalgslen; i++) {
const SIGALG_LOOKUP *sigptr = c->shared_sigalgs[i]; const SIGALG_LOOKUP *sigptr = c->shared_sigalgs[i];
int idx = sigptr->sig_idx;
/* Ignore PKCS1 based sig algs in TLSv1.3 */ /* Ignore PKCS1 based sig algs in TLSv1.3 */
if (SSL_IS_TLS13(s) && sigptr->sig == EVP_PKEY_RSA) if (SSL_IS_TLS13(s) && sigptr->sig == EVP_PKEY_RSA)
continue; continue;
idx = tls12_get_pkey_idx(sigptr->sig); /* If not disabled indicate we can explicitly sign */
if (idx >= 0 && pmd[idx] == NULL) { if (pvalid[idx] == 0 && tls12_get_pkey_idx(sigptr->sig) != -1)
md = ssl_md(sigptr->hash_idx); pvalid[sigptr->sig_idx] = CERT_PKEY_EXPLICIT_SIGN;
pmd[idx] = md;
pvalid[idx] = CERT_PKEY_EXPLICIT_SIGN;
}
}
/*
* In strict mode or TLS1.3 leave unset digests as NULL to indicate we can't
* use the certificate for signing.
*/
if (!(s->cert->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT)
&& !SSL_IS_TLS13(s)) {
/*
* Set any remaining keys to default values. NOTE: if alg is not
* supported it stays as NULL.
*/
#ifndef OPENSSL_NO_DSA
if (pmd[SSL_PKEY_DSA_SIGN] == NULL)
pmd[SSL_PKEY_DSA_SIGN] = EVP_sha1();
#endif
#ifndef OPENSSL_NO_RSA
if (pmd[SSL_PKEY_RSA] == NULL) {
pmd[SSL_PKEY_RSA] = EVP_sha1();
}
#endif
#ifndef OPENSSL_NO_EC
if (pmd[SSL_PKEY_ECC] == NULL)
pmd[SSL_PKEY_ECC] = EVP_sha1();
#endif
#ifndef OPENSSL_NO_GOST
if (pmd[SSL_PKEY_GOST01] == NULL)
pmd[SSL_PKEY_GOST01] = EVP_get_digestbynid(NID_id_GostR3411_94);
if (pmd[SSL_PKEY_GOST12_256] == NULL)
pmd[SSL_PKEY_GOST12_256] =
EVP_get_digestbynid(NID_id_GostR3411_2012_256);
if (pmd[SSL_PKEY_GOST12_512] == NULL)
pmd[SSL_PKEY_GOST12_512] =
EVP_get_digestbynid(NID_id_GostR3411_2012_512);
#endif
} }
return 1; return 1;
} }
@ -2020,7 +1948,7 @@ int tls1_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain,
rv |= CERT_PKEY_EE_SIGNATURE | CERT_PKEY_CA_SIGNATURE; rv |= CERT_PKEY_EE_SIGNATURE | CERT_PKEY_CA_SIGNATURE;
skip_sigs: skip_sigs:
/* Check cert parameters are consistent */ /* Check cert parameters are consistent */
if (tls1_check_cert_param(s, x, check_flags ? 1 : 2)) if (tls1_check_cert_param(s, x, 1))
rv |= CERT_PKEY_EE_PARAM; rv |= CERT_PKEY_EE_PARAM;
else if (!check_flags) else if (!check_flags)
goto end; goto end;
@ -2106,8 +2034,6 @@ int tls1_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain,
if (TLS1_get_version(s) >= TLS1_2_VERSION) { if (TLS1_get_version(s) >= TLS1_2_VERSION) {
if (*pvalid & CERT_PKEY_EXPLICIT_SIGN) if (*pvalid & CERT_PKEY_EXPLICIT_SIGN)
rv |= CERT_PKEY_EXPLICIT_SIGN | CERT_PKEY_SIGN; rv |= CERT_PKEY_EXPLICIT_SIGN | CERT_PKEY_SIGN;
else if (s->s3->tmp.md[idx] != NULL)
rv |= CERT_PKEY_SIGN;
} else } else
rv |= CERT_PKEY_SIGN | CERT_PKEY_EXPLICIT_SIGN; rv |= CERT_PKEY_SIGN | CERT_PKEY_EXPLICIT_SIGN;