Skip to content

Commit 81b55a8

Browse files
Fix SSL.getSigAlgs() on BoringSSL for TLS 1.3 (#924)
Motivation: Improper algorithm names returned by BoringSSL with TLS 1.3 Modifications: Always pass `false` as the second parameter to `SSL_get_signature_algorithm_name()`. This forces BoringSSL to omit the curve name and return algorithm names in the style expected by callers of `SSL.getSigAlgs()`. Previously this parameter was only false for TLS 1.2. Result: Fixes #923
1 parent e135a79 commit 81b55a8

File tree

1 file changed

+1
-1
lines changed
  • openssl-dynamic/src/main/c

1 file changed

+1
-1
lines changed

openssl-dynamic/src/main/c/ssl.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2583,7 +2583,7 @@ TCN_IMPLEMENT_CALL(jobjectArray, SSL, getSigAlgs)(TCN_STDARGS, jlong ssl) {
25832583
}
25842584

25852585
for (i = 0; i < num_peer_sigalgs; i++) {
2586-
if ((alg = SSL_get_signature_algorithm_name(peer_sigalgs[i], SSL_version(ssl_) != TLS1_2_VERSION)) == NULL) {
2586+
if ((alg = SSL_get_signature_algorithm_name(peer_sigalgs[i], false)) == NULL) {
25872587
// The signature algorithm is not known to BoringSSL, skip it.
25882588
continue;
25892589
}

0 commit comments

Comments
 (0)