diff options
| author | Theo Buehler <tb@cvs.openbsd.org> | 2021-11-19 18:53:11 +0000 |
|---|---|---|
| committer | Theo Buehler <tb@cvs.openbsd.org> | 2021-11-19 18:53:11 +0000 |
| commit | 7b61083405d39c5e28aa0b50e08303b0a40cf8f2 (patch) | |
| tree | a4fdf68112552da69771de76eb182c3471ccc26e /lib/libssl/ssl_clnt.c | |
| parent | dd118bfc88da6616e433fd76ca8a7dd24440b31d (diff) | |
libssl: don't reach for pkey->save_type.
For some strange historical reason ECDSA_sign() and ECDSA_verify}() have
a type argument that they ignore. For another strange historical reason,
the type passed to them from libssl is pkey->save_type, which is used to
avoid expensive engine lookups when setting the pkey type... Whatever the
aforementioned reasons were, we can't access pkey->save_type with the
OpenSSL 1.1 API, and this is thus in the way of making EVP_PKEY opaque.
Simply pass in 0 instead.
ok jsing
Diffstat (limited to 'lib/libssl/ssl_clnt.c')
| -rw-r--r-- | lib/libssl/ssl_clnt.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/lib/libssl/ssl_clnt.c b/lib/libssl/ssl_clnt.c index fe864d1cdcb..02bd3d5dfe1 100644 --- a/lib/libssl/ssl_clnt.c +++ b/lib/libssl/ssl_clnt.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssl_clnt.c,v 1.117 2021/10/25 10:01:46 jsing Exp $ */ +/* $OpenBSD: ssl_clnt.c,v 1.118 2021/11/19 18:53:10 tb Exp $ */ /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) * All rights reserved. * @@ -2427,8 +2427,8 @@ ssl3_send_client_verify_ec(SSL *s, EVP_PKEY *pkey, CBB *cert_verify) goto err; if ((signature = calloc(1, EVP_PKEY_size(pkey))) == NULL) goto err; - if (!ECDSA_sign(pkey->save_type, &data[MD5_DIGEST_LENGTH], - SHA_DIGEST_LENGTH, signature, &signature_len, pkey->pkey.ec)) { + if (!ECDSA_sign(0, &data[MD5_DIGEST_LENGTH], SHA_DIGEST_LENGTH, + signature, &signature_len, pkey->pkey.ec)) { SSLerror(s, ERR_R_ECDSA_LIB); goto err; } |