From afa98fcb556a3fc136058e38a1b3aeaf0041cfe3 Mon Sep 17 00:00:00 2001 From: Ali Mohammad Pur Date: Wed, 12 May 2021 05:22:18 +0430 Subject: LibTLS: Always send the signature_algorithms extension At some point since Sep 2018, OpenSSL added a ~~bug~~ feature that makes the default set of signature algorithms defined in TLSv1.2 unusable without reducing what they call the "security level", which caused communication with servers using more recent versions of openssl to fail with "internal error". This commit makes LibTLS always send its supported sigalgs, making the server not default to the insecure defaults, and thus enabling us to talk to such servers. --- Userland/Libraries/LibTLS/TLSv12.h | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) (limited to 'Userland/Libraries/LibTLS/TLSv12.h') diff --git a/Userland/Libraries/LibTLS/TLSv12.h b/Userland/Libraries/LibTLS/TLSv12.h index a941a2e35a..b45eff3a69 100644 --- a/Userland/Libraries/LibTLS/TLSv12.h +++ b/Userland/Libraries/LibTLS/TLSv12.h @@ -179,6 +179,28 @@ enum ClientVerificationStaus { VerificationNeeded, }; +enum class HashAlgorithm : u8 { + None = 0, + MD5 = 1, + SHA1 = 2, + SHA224 = 3, + SHA256 = 4, + SHA384 = 5, + SHA512 = 6, +}; + +enum class SignatureAlgorithm : u8 { + Anonymous = 0, + RSA = 1, + DSA = 2, + ECDSA = 3, +}; + +struct SignatureAndHashAlgorithm { + HashAlgorithm hash; + SignatureAlgorithm signature; +}; + struct Options { #define OPTION_WITH_DEFAULTS(typ, name, ...) \ static typ default_##name() { return typ { __VA_ARGS__ }; } \ @@ -192,6 +214,10 @@ struct Options { CipherSuite::RSA_WITH_AES_128_GCM_SHA256) OPTION_WITH_DEFAULTS(Version, version, Version::V12) + OPTION_WITH_DEFAULTS(Vector, supported_signature_algorithms, + { HashAlgorithm::SHA512, SignatureAlgorithm::RSA }, + { HashAlgorithm::SHA256, SignatureAlgorithm::RSA }, + { HashAlgorithm::SHA1, SignatureAlgorithm::RSA }); OPTION_WITH_DEFAULTS(bool, use_sni, true) OPTION_WITH_DEFAULTS(bool, use_compression, false) -- cgit v1.2.3