File 0139-ssl-Use-TLS-1.3-name-for-legacy-algorithm-... of Package erlang

Overview Repositories Revisions Requests Users Attributes Meta

File 0139-ssl-Use-TLS-1.3-name-for-legacy-algorithm-in-all-lis.patch of Package erlang (Revision a95c38533dd94a5c195230b3b146d029)

Currently displaying revision a95c38533dd94a5c195230b3b146d029 , Show latest

From 54b4c12f8c34640e017d76d48ee1f91d3f1c2a74 Mon Sep 17 00:00:00 2001
From: Ingela Anderton Andin <ingela@erlang.org>
Date: Sat, 13 Apr 2024 11:36:36 +0200
Subject: [PATCH] ssl: Use TLS-1.3 name for legacy algorithm in all listing

---
 lib/ssl/src/ssl.erl            | 6 +++---
 lib/ssl/src/tls_v1.erl         | 2 +-
 lib/ssl/test/tls_api_SUITE.erl | 8 ++++++--
 3 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/lib/ssl/src/ssl.erl b/lib/ssl/src/ssl.erl
index 38e9919fb5..4cca50bfd6 100644
--- a/lib/ssl/src/ssl.erl
+++ b/lib/ssl/src/ssl.erl
@@ -1148,9 +1148,9 @@ signature_algs(default, 'tlsv1.3') ->
 signature_algs(default, 'tlsv1.2') ->
     tls_v1:default_signature_algs([tls_record:protocol_version_name('tlsv1.2')]);
 signature_algs(all, 'tlsv1.3') ->
-   tls_v1:default_signature_algs([tls_record:protocol_version_name('tlsv1.3'), 
-                                  tls_record:protocol_version_name('tlsv1.2')]) ++ 
-        tls_v1:legacy_signature_algs_pre_13();
+    tls_v1:default_signature_algs([tls_record:protocol_version_name('tlsv1.3'),
+                                   tls_record:protocol_version_name('tlsv1.2')]) ++
+        [ecdsa_sha1, rsa_pkcs1_sha1 | tls_v1:legacy_signature_algs_pre_13()] -- [{sha, ecdsa}, {sha, rsa}];
 signature_algs(all, 'tlsv1.2') ->
     tls_v1:default_signature_algs([tls_record:protocol_version_name('tlsv1.2')]) ++ 
         tls_v1:legacy_signature_algs_pre_13();
diff --git a/lib/ssl/src/tls_v1.erl b/lib/ssl/src/tls_v1.erl
index 892a0d19fd..d38c4fb0da 100644
--- a/lib/ssl/src/tls_v1.erl
+++ b/lib/ssl/src/tls_v1.erl
@@ -906,7 +906,7 @@ default_pre_1_3_signature_algs_only() ->
     signature_algs(?TLS_1_2, Default).
 
 legacy_signature_algs_pre_13() ->
-    [{sha224, ecdsa}, {sha224, rsa}, {sha, rsa}, {sha, dsa}].
+    [{sha224, ecdsa}, {sha224, rsa}, {sha, ecdsa}, {sha, rsa}, {sha, dsa}].
 
 signature_schemes(Version, [_|_] =SignatureSchemes) when is_tuple(Version)
                                                          andalso ?TLS_GTE(Version, ?TLS_1_2) ->
diff --git a/lib/ssl/test/tls_api_SUITE.erl b/lib/ssl/test/tls_api_SUITE.erl
index ea4cdf2800..8499d4ff3f 100644
--- a/lib/ssl/test/tls_api_SUITE.erl
+++ b/lib/ssl/test/tls_api_SUITE.erl
@@ -1309,16 +1309,20 @@ signature_algs(Config) when is_list(Config) ->
     true = [] =/= [Alg || Alg <- ssl:signature_algs(default, 'tlsv1.3'), is_tuple(Alg)],
     true = [] == [Alg || Alg <- ssl:signature_algs(exclusive, 'tlsv1.3'), is_tuple(Alg)],
     true = ssl:signature_algs(exclusive, 'tlsv1.3') =/=  ssl:signature_algs(exclusive, 'tlsv1.2'),
-    true = length(ssl:signature_algs(defalt, 'tlsv1.2')) <
+    true = length(ssl:signature_algs(default, 'tlsv1.2')) <
         length(ssl:signature_algs(all, 'tlsv1.2')),
     TLS_1_3_All = ssl:signature_algs(all, 'tlsv1.3'),
     true = lists:member(rsa_pkcs1_sha512, TLS_1_3_All) andalso (not lists:member({sha512, rsa}, TLS_1_3_All)),
     true = lists:member(rsa_pkcs1_sha384, TLS_1_3_All) andalso (not lists:member({sha384, rsa}, TLS_1_3_All)),
     true = lists:member(rsa_pkcs1_sha256, TLS_1_3_All) andalso (not lists:member({sha256, rsa}, TLS_1_3_All)),
+    true = lists:member(rsa_pkcs1_sha, TLS_1_3_All) andalso (not lists:member({sha, rsa}, TLS_1_3_All)),
+    true = lists:member(ecdsa_sha1, TLS_1_3_All) andalso (not lists:member({sha, ecdsa}, TLS_1_3_All)),
     TLS_1_2_All = ssl:signature_algs(all, 'tlsv1.2'),
     true = (not lists:member(rsa_pkcs1_sha512, TLS_1_2_All)) andalso lists:member({sha512, rsa}, TLS_1_2_All),
     true = (not lists:member(rsa_pkcs1_sha384, TLS_1_2_All)) andalso lists:member({sha384, rsa}, TLS_1_2_All),
-    true = (not lists:member(rsa_pkcs1_sha256, TLS_1_2_All)) andalso lists:member({sha256, rsa}, TLS_1_2_All).
+    true = (not lists:member(rsa_pkcs1_sha256, TLS_1_2_All)) andalso lists:member({sha256, rsa}, TLS_1_2_All),
+    true = (not lists:member(rsa_pkcs1_sha, TLS_1_2_All)) andalso lists:member({sha, rsa}, TLS_1_2_All),
+    true = (not lists:member(ecdsa_sha1, TLS_1_2_All)) andalso lists:member({sha, ecdsa}, TLS_1_2_All).
 
 %%--------------------------------------------------------------------
 %% Internal functions ------------------------------------------------
-- 
2.35.3

Places

File 0139-ssl-Use-TLS-1.3-name-for-legacy-algorithm-in-all-lis.patch of Package erlang (Revision a95c38533dd94a5c195230b3b146d029)

Places