summaryrefslogtreecommitdiff
path: root/src/lib/libssl/ssl_srvr.c
diff options
context:
space:
mode:
authortb <>2022-06-29 08:27:52 +0000
committertb <>2022-06-29 08:27:52 +0000
commitd514ed3f0a5ed2d924983d4533a179823bf09ca0 (patch)
tree737bede5c25ec5b6855578423751b08517e50653 /src/lib/libssl/ssl_srvr.c
parent24c464130eda826952b6d98e975e3dd7c8181b84 (diff)
downloadopenbsd-d514ed3f0a5ed2d924983d4533a179823bf09ca0.tar.gz
openbsd-d514ed3f0a5ed2d924983d4533a179823bf09ca0.tar.bz2
openbsd-d514ed3f0a5ed2d924983d4533a179823bf09ca0.zip
Check the security of DH key shares
ok beck, looks good to jsing
Diffstat (limited to 'src/lib/libssl/ssl_srvr.c')
-rw-r--r--src/lib/libssl/ssl_srvr.c8
1 files changed, 7 insertions, 1 deletions
diff --git a/src/lib/libssl/ssl_srvr.c b/src/lib/libssl/ssl_srvr.c
index 97077a3380..e37f9cfdb7 100644
--- a/src/lib/libssl/ssl_srvr.c
+++ b/src/lib/libssl/ssl_srvr.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ssl_srvr.c,v 1.144 2022/06/29 07:53:58 tb Exp $ */ 1/* $OpenBSD: ssl_srvr.c,v 1.145 2022/06/29 08:27:51 tb Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved. 3 * All rights reserved.
4 * 4 *
@@ -1355,6 +1355,12 @@ ssl3_send_server_kex_dhe(SSL *s, CBB *cbb)
1355 if (!tls_key_share_public(s->s3->hs.key_share, cbb)) 1355 if (!tls_key_share_public(s->s3->hs.key_share, cbb))
1356 goto err; 1356 goto err;
1357 1357
1358 if (!tls_key_share_peer_security(s, s->s3->hs.key_share)) {
1359 SSLerror(s, SSL_R_DH_KEY_TOO_SMALL);
1360 ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE);
1361 return 0;
1362 }
1363
1358 return 1; 1364 return 1;
1359 1365
1360 err: 1366 err: