[gnutls-devel] GnuTLS | make insecure-hash filter out ciphersuites on ->prf as well (!1479)

[Read-only notification of GnuTLS library development activities]

Alexander Sosedkin commented on a discussion on lib/priority.c: https://gitlab.com/gnutls/gnutls/-/merge_requests/1479#note_709501376

>  				priority_cache->_mac.priorities[z]);
> +			if (ce == NULL)
> +				continue;
>  
> -			if (ce != NULL && priority_cache->cs.size < MAX_CIPHERSUITE_SIZE) {
> -				priority_cache->cs.entry[priority_cache->cs.size++] = ce;
> -			}
> +			prf_digest = MAC_TO_DIG(ce->prf);
> +			if (prf_digest == GNUTLS_DIG_UNKNOWN)
> +				continue;
> +			if (_gnutls_digest_is_insecure(prf_digest))
> +				continue;
> +
> +			if (priority_cache->cs.size == MAX_CIPHERSUITE_SIZE)
> +				continue;
> +			priority_cache->cs.entry[priority_cache->cs.size++] = ce;

No problem, I've specifically asked for that. Updated.

-- 
Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/merge_requests/1479#note_709501376
You're receiving this email because of your account on gitlab.com.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.gnupg.org/pipermail/gnutls-devel/attachments/20211020/c65d64c2/attachment-0001.html>