Allow signature algorithms in TLS 1.3 certificate request extensions.
authorDr. Stephen Henson <steve@openssl.org>
Mon, 13 Mar 2017 13:27:18 +0000 (13:27 +0000)
committerDr. Stephen Henson <steve@openssl.org>
Fri, 17 Mar 2017 18:41:56 +0000 (18:41 +0000)
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2918)

ssl/statem/extensions.c
ssl/statem/statem_locl.h

index d62c5af..c4fc760 100644 (file)
@@ -159,8 +159,9 @@ static const EXTENSION_DEFINITION ext_defs[] = {
     },
     {
         TLSEXT_TYPE_signature_algorithms,
-        EXT_CLIENT_HELLO,
-        init_sig_algs, tls_parse_ctos_sig_algs, NULL, NULL,
+        EXT_CLIENT_HELLO | EXT_TLS1_3_CERTIFICATE_REQUEST,
+        init_sig_algs, tls_parse_ctos_sig_algs,
+        tls_parse_ctos_sig_algs, tls_construct_ctos_sig_algs,
         tls_construct_ctos_sig_algs, final_sig_algs
     },
 #ifndef OPENSSL_NO_OCSP
index f16ba11..9bf1d8a 100644 (file)
@@ -53,6 +53,7 @@
 #define EXT_TLS1_3_HELLO_RETRY_REQUEST      0x0400
 #define EXT_TLS1_3_CERTIFICATE              0x0800
 #define EXT_TLS1_3_NEW_SESSION_TICKET       0x1000
+#define EXT_TLS1_3_CERTIFICATE_REQUEST      0x2000
 
 /* Dummy message type */
 #define SSL3_MT_DUMMY   -1