[gnutls-devel] GnuTLS | make insecure-hash filter out ciphersuites on ->prf as well (!1479)

[Read-only notification of GnuTLS library development activities]

Daiki Ueno started a new discussion on lib/priority.c: https://gitlab.com/gnutls/gnutls/-/merge_requests/1479#note_709790051

> -						have_ec = 1;
> -						add_ec(priority_cache);
> -					}
> -					if (!have_dh && _gnutls_kx_is_dhe(ce->kx_algorithm)) {
> -						have_dh = 1;
> -						add_dh(priority_cache);
> -					}
> +				prf_digest = MAC_TO_DIG(ce->prf);
> +				if (prf_digest == GNUTLS_DIG_UNKNOWN)
> +					continue;
> +				if (_gnutls_digest_is_insecure(prf_digest))
> +					continue;
> +
> +				if (priority_cache->cs.size == MAX_CIPHERSUITE_SIZE)
> +					continue;
> +				priority_cache->cs.entry[priority_cache->cs.size++] = ce;

While the CI is blocking merge, here is one more:
```suggestion:-2+0
				if (priority_cache->cs.size < MAX_CIPHERSUITE_SIZE)
					priority_cache->cs.entry[priority_cache->cs.size++] = ce;
```

-- 
Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/merge_requests/1479#note_709790051
You're receiving this email because of your account on gitlab.com.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.gnupg.org/pipermail/gnutls-devel/attachments/20211021/6a0d8ce9/attachment.html>