diff options
| author | David Benjamin <davidben@chromium.org> | 2014-08-26 08:32:30 +0400 |
|---|---|---|
| committer | Adam Langley <agl@google.com> | 2014-08-27 05:55:27 +0400 |
| commit | 854dd654d1cf168397b6df8d6a4964288d206e2f (patch) | |
| tree | 09d12e52fb863119bfd2aebb2d923eaf4424638c /ssl/d1_srvr.c | |
| parent | 5b8f104ee8304f535f1ae9ebe4c749143eb4e8c5 (diff) | |
Refactor server-side CertificateVerify handling.
This moves CertificateVerify digest processing to the new
SSL_GET_MESSAGE_DONT_HASH_MESSAGE flag. It also refactors it similarly to
ssl3_send_cert_verify and moves that logic to a common ssl3_cert_verify_hash
function to compute the handshake hash.
This removes a large chunk of duplicate (and divergent!) logic between TLS and
DTLS. It also removes TLS1_FLAGS_KEEP_HANDSHAKE.
Change-Id: Ia63c94f7d76d901bc9c4c33454fbfede411adf63
Reviewed-on: https://boringssl-review.googlesource.com/1633
Reviewed-by: Adam Langley <agl@google.com>
Diffstat (limited to 'ssl/d1_srvr.c')
| -rw-r--r-- | ssl/d1_srvr.c | 31 |
1 files changed, 0 insertions, 31 deletions
diff --git a/ssl/d1_srvr.c b/ssl/d1_srvr.c index 2b45874f..102d442a 100644 --- a/ssl/d1_srvr.c +++ b/ssl/d1_srvr.c @@ -485,37 +485,6 @@ int dtls1_accept(SSL *s) goto end; s->state=SSL3_ST_SR_CERT_VRFY_A; s->init_num=0; - - /* TODO(davidben): These two blocks are different - * between SSL and DTLS. Resolve the difference and code - * duplication. */ - if (SSL_USE_SIGALGS(s)) - { - if (!s->session->peer) - break; - /* For sigalgs freeze the handshake buffer - * at this point and digest cached records. - */ - if (!s->s3->handshake_buffer) - { - OPENSSL_PUT_ERROR(SSL, dtls1_accept, ERR_R_INTERNAL_ERROR); - return -1; - } - s->s3->flags |= TLS1_FLAGS_KEEP_HANDSHAKE; - if (!ssl3_digest_cached_records(s)) - return -1; - } - else - { - /* We need to get hashes here so if there is - * a client cert, it can be verified */ - s->method->ssl3_enc->cert_verify_mac(s, - NID_md5, - &(s->s3->tmp.cert_verify_md[0])); - s->method->ssl3_enc->cert_verify_mac(s, - NID_sha1, - &(s->s3->tmp.cert_verify_md[MD5_DIGEST_LENGTH])); - } break; case SSL3_ST_SR_CERT_VRFY_A: |