diff --git a/ChangeLog b/ChangeLog index e431d8de2..9e025daec 100644 --- a/ChangeLog +++ b/ChangeLog @@ -8,6 +8,9 @@ Bugfix * Fix usage help in ssl_server2 example. Found and fixed by Bei Lin. * Fix Visual Studio implicit cast compilation warnings in the net.c and x509.c modules and some sample applications. + * Parse signature algorithm extension when renegotiating. Previously, + renegotiated handshakes would only accept signatures using SHA-1 + regardless of the peer's preferences, or fail if SHA-1 was disabled. = mbed TLS 1.3.21 branch released 2017-08-10 diff --git a/library/ssl_srv.c b/library/ssl_srv.c index 146f28310..0f0369aa4 100644 --- a/library/ssl_srv.c +++ b/library/ssl_srv.c @@ -1675,10 +1675,6 @@ static int ssl_parse_client_hello( ssl_context *ssl ) defined(POLARSSL_KEY_EXCHANGE__WITH_CERT__ENABLED) case TLS_EXT_SIG_ALG: SSL_DEBUG_MSG( 3, ( "found signature_algorithms extension" ) ); - #if defined(POLARSSL_SSL_RENEGOTIATION) - if( ssl->renegotiation == SSL_RENEGOTIATION ) - break; - #endif ret = ssl_parse_signature_algorithms_ext( ssl, ext + 4, ext_size ); if( ret != 0 )