From 4d24ae9a4d4b96a3791eb3def2c672d7ec644c8c Mon Sep 17 00:00:00 2001
From: Ingela Anderton Andin <ingela@erlang.org>
Date: Tue, 19 Oct 2010 09:29:02 +0200
Subject: Correct handling of client certificate verify message

When checking the client certificate verify message the server used
the wrong algorithm identifier to determine the signing algorithm,
causing a function clause error in the public_key application when the
key-exchange algorithm and the public key algorithm of the client
certificate happen to differ.
---
 lib/ssl/src/ssl_connection.erl | 21 +++++++--------------
 1 file changed, 7 insertions(+), 14 deletions(-)

(limited to 'lib/ssl/src/ssl_connection.erl')

diff --git a/lib/ssl/src/ssl_connection.erl b/lib/ssl/src/ssl_connection.erl
index c94199c336..c3f16699a1 100644
--- a/lib/ssl/src/ssl_connection.erl
+++ b/lib/ssl/src/ssl_connection.erl
@@ -653,12 +653,10 @@ cipher(#certificate_verify{signature = Signature},
 	      public_key_info = PublicKeyInfo,
 	      negotiated_version = Version,
 	      session = #session{master_secret = MasterSecret},
-	      key_algorithm = Algorithm,
 	      tls_handshake_hashes = Hashes
 	     } = State0) -> 
     case ssl_handshake:certificate_verify(Signature, PublicKeyInfo,
-					  Version, MasterSecret, 
-					  Algorithm, Hashes) of
+					  Version, MasterSecret, Hashes) of
 	valid ->
 	    {Record, State} = next_record(State0),
 	    next_state(cipher, Record, State);
@@ -1182,16 +1180,15 @@ verify_client_cert(#state{client_certificate_requested = true, role = client,
 			  negotiated_version = Version,
 			  own_cert = OwnCert,
 			  socket = Socket,
-			  key_algorithm = KeyAlg,
 			  private_key = PrivateKey,
 			  session = #session{master_secret = MasterSecret},
 			  tls_handshake_hashes = Hashes0} = State) ->
+
     case ssl_handshake:client_certificate_verify(OwnCert, MasterSecret, 
-						 Version, KeyAlg, 
-						 PrivateKey, Hashes0) of
+						 Version, PrivateKey, Hashes0) of
         #certificate_verify{} = Verified ->
             {BinVerified, ConnectionStates1, Hashes1} = 
-                encode_handshake(Verified, KeyAlg, Version, 
+                encode_handshake(Verified, Version,
                                  ConnectionStates0, Hashes0),
             Transport:send(Socket, BinVerified),
             State#state{connection_states = ConnectionStates1,
@@ -1585,13 +1582,9 @@ encode_change_cipher(#change_cipher_spec{}, Version, ConnectionStates) ->
     ?DBG_TERM(#change_cipher_spec{}),
     ssl_record:encode_change_cipher_spec(Version, ConnectionStates).
 
-encode_handshake(HandshakeRec, Version, ConnectionStates, Hashes) ->
-    encode_handshake(HandshakeRec, null, Version, 
-		     ConnectionStates, Hashes).
-
-encode_handshake(HandshakeRec, SigAlg, Version, ConnectionStates0, Hashes0) ->
+encode_handshake(HandshakeRec, Version, ConnectionStates0, Hashes0) ->
     ?DBG_TERM(HandshakeRec),
-    Frag = ssl_handshake:encode_handshake(HandshakeRec, Version, SigAlg),
+    Frag = ssl_handshake:encode_handshake(HandshakeRec, Version),
     Hashes1 = ssl_handshake:update_hashes(Hashes0, Frag),
     {E, ConnectionStates1} =
         ssl_record:encode_handshake(Frag, Version, ConnectionStates0),
@@ -2179,7 +2172,7 @@ renegotiate(#state{role = server,
 		   negotiated_version = Version,
 		   connection_states = ConnectionStates0} = State0) ->
     HelloRequest = ssl_handshake:hello_request(),
-    Frag = ssl_handshake:encode_handshake(HelloRequest, Version, null),
+    Frag = ssl_handshake:encode_handshake(HelloRequest, Version),
     Hs0 = ssl_handshake:init_hashes(),
     {BinMsg, ConnectionStates} = 
 	ssl_record:encode_handshake(Frag, Version, ConnectionStates0),
-- 
cgit v1.2.3