diff options
| author | David Benjamin <davidben@chromium.org> | 2014-08-20 04:21:56 +0400 |
|---|---|---|
| committer | Adam Langley <agl@google.com> | 2014-08-20 06:14:40 +0400 |
| commit | ef2116d33c3c1b38005eb59caa2aaa6300a9b450 (patch) | |
| tree | dc0b4d4eb99317f1bb97f10a06af36588079781f /ssl/ssl_lib.c | |
| parent | cff6472442de2e65f95fa04893b12b1412118f60 (diff) | |
Remove DSA-based cipher suites and client auth.
DSA is not connected up to EVP, so it wouldn't work anyway. We shouldn't
advertise a cipher suite we don't support. Chrome UMA data says virtually no
handshakes end up negotiating one of these.
Change-Id: I874d934432da6318f05782ebd149432c1d1e5275
Reviewed-on: https://boringssl-review.googlesource.com/1566
Reviewed-by: Adam Langley <agl@google.com>
Diffstat (limited to 'ssl/ssl_lib.c')
| -rw-r--r-- | ssl/ssl_lib.c | 14 |
1 files changed, 2 insertions, 12 deletions
diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c index 5bf24385..16b5b3d4 100644 --- a/ssl/ssl_lib.c +++ b/ssl/ssl_lib.c @@ -2168,7 +2168,7 @@ void SSL_set_cert_cb(SSL *s, int (*cb)(SSL *ssl, void *arg), void *arg) void ssl_set_cert_masks(CERT *c, const SSL_CIPHER *cipher) { CERT_PKEY *cpk; - int rsa_enc,rsa_sign,dh_tmp,dsa_sign; + int rsa_enc,rsa_sign,dh_tmp; unsigned long mask_k,mask_a; #ifndef OPENSSL_NO_ECDSA int have_ecc_cert, ecdsa_ok; @@ -2194,8 +2194,6 @@ void ssl_set_cert_masks(CERT *c, const SSL_CIPHER *cipher) rsa_enc= cpk->valid_flags & CERT_PKEY_VALID; cpk= &(c->pkeys[SSL_PKEY_RSA_SIGN]); rsa_sign= cpk->valid_flags & CERT_PKEY_SIGN; - cpk= &(c->pkeys[SSL_PKEY_DSA_SIGN]); - dsa_sign= cpk->valid_flags & CERT_PKEY_SIGN; cpk= &(c->pkeys[SSL_PKEY_ECC]); #ifndef OPENSSL_NO_EC have_ecc_cert= cpk->valid_flags & CERT_PKEY_VALID; @@ -2220,11 +2218,6 @@ void ssl_set_cert_masks(CERT *c, const SSL_CIPHER *cipher) mask_a|=SSL_aRSA; } - if (dsa_sign) - { - mask_a|=SSL_aDSS; - } - mask_a|=SSL_aNULL; /* An ECC certificate may be usable for ECDSA cipher suites depending on @@ -2355,10 +2348,7 @@ EVP_PKEY *ssl_get_sign_pkey(SSL *s,const SSL_CIPHER *cipher, const EVP_MD **pmd) else #endif - if ((alg_a & SSL_aDSS) && - (c->pkeys[SSL_PKEY_DSA_SIGN].privatekey != NULL)) - idx = SSL_PKEY_DSA_SIGN; - else if (alg_a & SSL_aRSA) + if (alg_a & SSL_aRSA) { if (c->pkeys[SSL_PKEY_RSA_SIGN].privatekey != NULL) idx = SSL_PKEY_RSA_SIGN; |