diff options
| author | Nikos Mavrogiannopoulos <nmav@redhat.com> | 2017-09-14 12:13:09 +0200 |
|---|---|---|
| committer | Nikos Mavrogiannopoulos <nmav@redhat.com> | 2018-02-19 15:29:33 +0100 |
| commit | a118b7bc55e2ed0bae8d013f4dbcabe30301f8fb (patch) | |
| tree | ef3c6dd4c5655405dd685db8bd77ec46f9429d07 /lib/priority.c | |
| parent | bfed35761541fdf734ef5a0cce82d41314271ba5 (diff) | |
| download | gnutls-a118b7bc55e2ed0bae8d013f4dbcabe30301f8fb.tar.gz | |
ext/signature: improved TLS 1.3 signature algorithm negotiation
That is, we introduce a simpler way to handle multiple versions
of a single signature algorithm.
Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
Diffstat (limited to 'lib/priority.c')
| -rw-r--r-- | lib/priority.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/lib/priority.c b/lib/priority.c index 5f6134ef93..e038f5b7f1 100644 --- a/lib/priority.c +++ b/lib/priority.c @@ -1201,11 +1201,13 @@ static int set_ciphersuite_list(gnutls_priority_t priority_cache) if (priority_cache->protocol.priority[i] < GNUTLS_DTLS_VERSION_MIN) { tlsmax = version_to_entry(priority_cache->protocol.priority[i]); if (tlsmax) - tls_sig_sem = tlsmax->tls_sig_sem; + tls_sig_sem |= tlsmax->tls_sig_sem; if (dtlsmax) break; } else { /* dtls */ dtlsmax = version_to_entry(priority_cache->protocol.priority[i]); + if (dtlsmax) + tls_sig_sem |= dtlsmax->tls_sig_sem; if (tlsmax) break; } @@ -1249,9 +1251,9 @@ static int set_ciphersuite_list(gnutls_priority_t priority_cache) for (i = 0; i < priority_cache->_sign_algo.algorithms; i++) { se = _gnutls_sign_to_entry(priority_cache->_sign_algo.priority[i]); if (se != NULL && priority_cache->sigalg.size < sizeof(priority_cache->sigalg.entry)/sizeof(priority_cache->sigalg.entry[0])) { - /* if the signature algorithm semantics are higher than + /* if the signature algorithm semantics are not compatible with * the protocol's, then skip. */ - if (se->aid.tls_sem > tls_sig_sem) + if ((se->aid.tls_sem & tls_sig_sem) == 0) continue; priority_cache->sigalg.entry[priority_cache->sigalg.size++] = se; } |