generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Only allow a temporary rsa key exchange when they key is larger than 512.

Browse Source 
Reviewed-by: Rich Salz <rsalz@openssl.org>
MR #838

(cherry picked from commit 57e477b9ec66542afc8c9c13ae7c4271209fb88f)
This commit is contained in:
Kurt Roeckx 2015-04-18 19:15:48 +02:00
parent c4ce10773f
commit f3b355fec3
1 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
ssl/s3_clnt.c
View File

@ -341,7 +341,7 @@ int ssl3_connect(SSL *s)
if (!
(s->s3->tmp.
new_cipher->algorithm_auth & (SSL_aNULL | SSL_aSRP))
&& !(s->s3->tmp.new_cipher->algorithm_mkey & SSL_kPSK)) {
&& !(s->s3->tmp.new_cipher->algorithm_mkey & SSL_kPSK)) {
ret = ssl3_get_server_certificate(s);
if (ret <= 0)
goto end;
@ -1596,6 +1596,13 @@ int ssl3_get_key_exchange(SSL *s)
SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
goto err;
}
if (EVP_PKEY_bits(pkey) <= SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher)) {
al = SSL_AD_UNEXPECTED_MESSAGE;
SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, SSL_R_UNEXPECTED_MESSAGE);
goto f_err;
}
s->session->sess_cert->peer_rsa_tmp = rsa;
rsa = NULL;
}