From 788be4a3f47cea5fcb86abf59321c729057830ed Mon Sep 17 00:00:00 2001 From: David Benjamin Date: Fri, 30 Oct 2015 17:50:57 -0400 Subject: [PATCH] Remove the hard-coded SHA-1 exception for sigalgs. This is completely a no-op as currently tls12_get_psigalgs always returns a hardcoded list which always includes SHA-1. But if this were to be made configurable in the future, we should reject SHA-1 when configured to do so. Change-Id: I7ab188eeff850d1e5f70b9522304812bab2d941a Reviewed-on: https://boringssl-review.googlesource.com/6411 Reviewed-by: Adam Langley --- ssl/t1_lib.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c index 881a15a7..301d49a1 100644 --- a/ssl/t1_lib.c +++ b/ssl/t1_lib.c @@ -697,8 +697,7 @@ int tls12_check_peer_sigalg(const EVP_MD **out_md, int *out_alert, SSL *s, } } - /* Allow fallback to SHA-1. */ - if (i == sent_sigslen && hash != TLSEXT_hash_sha1) { + if (i == sent_sigslen) { OPENSSL_PUT_ERROR(SSL, SSL_R_WRONG_SIGNATURE_TYPE); *out_alert = SSL_AD_ILLEGAL_PARAMETER; return 0;