[gnutls-devel] GnuTLS | make insecure-hash filter out ciphersuites on ->prf as well (!1479)

[Read-only notification of GnuTLS library development activities]

Alexander Sosedkin commented on a discussion on lib/priority.c: https://gitlab.com/gnutls/gnutls/-/merge_requests/1479#note_709953205

> -						have_ec = 1;
> -						add_ec(priority_cache);
> -					}
> -					if (!have_dh && _gnutls_kx_is_dhe(ce->kx_algorithm)) {
> -						have_dh = 1;
> -						add_dh(priority_cache);
> -					}
> +				prf_digest = MAC_TO_DIG(ce->prf);
> +				if (prf_digest == GNUTLS_DIG_UNKNOWN)
> +					continue;
> +				if (_gnutls_digest_is_insecure(prf_digest))
> +					continue;
> +
> +				if (priority_cache->cs.size == MAX_CIPHERSUITE_SIZE)
> +					continue;
> +				priority_cache->cs.entry[priority_cache->cs.size++] = ce;

Not really, I don't want the following lines to trigger (and the nesting's already deep enough around here).

-- 
Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/merge_requests/1479#note_709953205
You're receiving this email because of your account on gitlab.com.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.gnupg.org/pipermail/gnutls-devel/attachments/20211021/04e7f2df/attachment-0001.html>