generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Continuing TLS v1.2 support: add support for server parsing of

Browse Source 
signature algorithms extension and correct signature format for
server key exchange.

All ciphersuites should now work on the server but no client support and
no client certificate support yet.
This commit is contained in:
Dr. Stephen Henson
2011-05-06 13:00:07 +00:00
parent c184711124
commit 6b7be581e5
9 changed files with 286 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
ssl/ssl_lib.c
View File

@@ -2322,34 +2322,36 @@ X509 *ssl_get_server_send_cert(SSL *s)
return(c->pkeys[i].x509);
}
EVP_PKEY *ssl_get_sign_pkey(SSL *s,const SSL_CIPHER *cipher)
EVP_PKEY *ssl_get_sign_pkey(SSL *s,const SSL_CIPHER *cipher, const EVP_MD **pmd)
{
unsigned long alg_a;
CERT *c;
int idx = -1;
alg_a = cipher->algorithm_auth;
c=s->cert;
if ((alg_a & SSL_aDSS) &&
(c->pkeys[SSL_PKEY_DSA_SIGN].privatekey != NULL))
return(c->pkeys[SSL_PKEY_DSA_SIGN].privatekey);
idx = SSL_PKEY_DSA_SIGN;
else if (alg_a & SSL_aRSA)
{
if (c->pkeys[SSL_PKEY_RSA_SIGN].privatekey != NULL)
return(c->pkeys[SSL_PKEY_RSA_SIGN].privatekey);
idx = SSL_PKEY_RSA_SIGN;
else if (c->pkeys[SSL_PKEY_RSA_ENC].privatekey != NULL)
return(c->pkeys[SSL_PKEY_RSA_ENC].privatekey);
else
return(NULL);
idx = SSL_PKEY_RSA_ENC;
}
else if ((alg_a & SSL_aECDSA) &&
(c->pkeys[SSL_PKEY_ECC].privatekey != NULL))
return(c->pkeys[SSL_PKEY_ECC].privatekey);
else /* if (alg_a & SSL_aNULL) */
idx = SSL_PKEY_ECC;
if (idx == -1)
{
SSLerr(SSL_F_SSL_GET_SIGN_PKEY,ERR_R_INTERNAL_ERROR);
return(NULL);
}
if (pmd)
*pmd = c->pkeys[idx].digest;
return c->pkeys[idx].privatekey;
}
void ssl_update_cache(SSL *s,int mode)