[gnutls-devel] GnuTLS | make insecure-hash filter out ciphersuites on ->prf as well (!1479)

[Read-only notification of GnuTLS library development activities]

Daiki Ueno commented on a discussion on lib/priority.c: https://gitlab.com/gnutls/gnutls/-/merge_requests/1479#note_710009717

> -						have_ec = 1;
> -						add_ec(priority_cache);
> -					}
> -					if (!have_dh && _gnutls_kx_is_dhe(ce->kx_algorithm)) {
> -						have_dh = 1;
> -						add_dh(priority_cache);
> -					}
> +				prf_digest = MAC_TO_DIG(ce->prf);
> +				if (prf_digest == GNUTLS_DIG_UNKNOWN)
> +					continue;
> +				if (_gnutls_digest_is_insecure(prf_digest))
> +					continue;
> +
> +				if (priority_cache->cs.size == MAX_CIPHERSUITE_SIZE)
> +					continue;
> +				priority_cache->cs.entry[priority_cache->cs.size++] = ce;

Ah, sorry; missed that. Looks good to me.

-- 
Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/merge_requests/1479#note_710009717
You're receiving this email because of your account on gitlab.com.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.gnupg.org/pipermail/gnutls-devel/attachments/20211021/8b59ee7f/attachment.html>