generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Check for missing DSA parameters.

Browse Source 
If DSA parameters are absent return -1 (for unknown) in DSA_security_bits.

If parameters are absent when a certificate is set in an SSL/SSL_CTX
structure this will reject the certificate by default. This will cause DSA
certificates which omit parameters to be rejected but that is never (?)
done in practice.

Thanks to Brian 'geeknik' Carpenter for reporting this issue.

Reviewed-by: Emilia Käsper <emilia@openssl.org>
This commit is contained in:
Dr. Stephen Henson 2015-12-30 13:34:53 +00:00
parent 923ffa97d1
commit 72245f340c
2 changed files with 11 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
crypto/dsa/dsa_lib.c
View File

@ -246,7 +246,9 @@ void *DSA_get_ex_data(DSA *d, int idx)
int DSA_security_bits(const DSA *d)
{
return BN_security_bits(BN_num_bits(d->p), BN_num_bits(d->q));
if (d->p && d->q)
return BN_security_bits(BN_num_bits(d->p), BN_num_bits(d->q));
return -1;
}
#ifndef OPENSSL_NO_DH

11
ssl/t1_lib.c
View File

@ -4253,13 +4253,18 @@ DH *ssl_get_auto_dh(SSL *s)
static int ssl_security_cert_key(SSL *s, SSL_CTX *ctx, X509 *x, int op)
{
int secbits;
int secbits = -1;
EVP_PKEY *pkey = X509_get_pubkey(x);
if (pkey) {
/*
* If no parameters this will return -1 and fail using the default
* security callback for any non-zero security level. This will
* reject keys which omit parameters but this only affects DSA and
* omission of parameters is never (?) done in practice.
*/
secbits = EVP_PKEY_security_bits(pkey);
EVP_PKEY_free(pkey);
} else
secbits = -1;
}
if (s)
return ssl_security(s, op, secbits, 0, x);
else