diff options
author | tb <> | 2022-06-29 08:27:52 +0000 |
---|---|---|
committer | tb <> | 2022-06-29 08:27:52 +0000 |
commit | d514ed3f0a5ed2d924983d4533a179823bf09ca0 (patch) | |
tree | 737bede5c25ec5b6855578423751b08517e50653 /src/lib/libssl/ssl_srvr.c | |
parent | 24c464130eda826952b6d98e975e3dd7c8181b84 (diff) | |
download | openbsd-d514ed3f0a5ed2d924983d4533a179823bf09ca0.tar.gz openbsd-d514ed3f0a5ed2d924983d4533a179823bf09ca0.tar.bz2 openbsd-d514ed3f0a5ed2d924983d4533a179823bf09ca0.zip |
Check the security of DH key shares
ok beck, looks good to jsing
Diffstat (limited to 'src/lib/libssl/ssl_srvr.c')
-rw-r--r-- | src/lib/libssl/ssl_srvr.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/src/lib/libssl/ssl_srvr.c b/src/lib/libssl/ssl_srvr.c index 97077a3380..e37f9cfdb7 100644 --- a/src/lib/libssl/ssl_srvr.c +++ b/src/lib/libssl/ssl_srvr.c | |||
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: ssl_srvr.c,v 1.144 2022/06/29 07:53:58 tb Exp $ */ | 1 | /* $OpenBSD: ssl_srvr.c,v 1.145 2022/06/29 08:27:51 tb Exp $ */ |
2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) |
3 | * All rights reserved. | 3 | * All rights reserved. |
4 | * | 4 | * |
@@ -1355,6 +1355,12 @@ ssl3_send_server_kex_dhe(SSL *s, CBB *cbb) | |||
1355 | if (!tls_key_share_public(s->s3->hs.key_share, cbb)) | 1355 | if (!tls_key_share_public(s->s3->hs.key_share, cbb)) |
1356 | goto err; | 1356 | goto err; |
1357 | 1357 | ||
1358 | if (!tls_key_share_peer_security(s, s->s3->hs.key_share)) { | ||
1359 | SSLerror(s, SSL_R_DH_KEY_TOO_SMALL); | ||
1360 | ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE); | ||
1361 | return 0; | ||
1362 | } | ||
1363 | |||
1358 | return 1; | 1364 | return 1; |
1359 | 1365 | ||
1360 | err: | 1366 | err: |