summaryrefslogtreecommitdiff
path: root/src/lib
diff options
context:
space:
mode:
authorguenther <>2014-07-28 04:23:12 +0000
committerguenther <>2014-07-28 04:23:12 +0000
commit224cc55e7b0aa21110d14dd564e88e13893a294e (patch)
tree51d2af22ad1dd980f4ce9c87fa7c5ea39efd7be6 /src/lib
parent23872c177fa5acf651189cdfcafd44e94da780ef (diff)
downloadopenbsd-224cc55e7b0aa21110d14dd564e88e13893a294e.tar.gz
openbsd-224cc55e7b0aa21110d14dd564e88e13893a294e.tar.bz2
openbsd-224cc55e7b0aa21110d14dd564e88e13893a294e.zip
The RSA, DH, and ECDH temporary key callbacks expect the number of keybits
for the key (expressed in RSA key bits, which makes *no sense* for ECDH) as their second argument, not zero. (jsing@ notes that the RSA callback is only invoked for 'export' ciphers, which have been removed from LibreSSL, and for the SSL_OP_EPHEMERAL_RSA option, which is makes the application non-compliant. More fuel for the tedu fire...) jasper@ noted the breakage and bisected it down to the diff that broke this ok jsing@ miod@
Diffstat (limited to 'src/lib')
-rw-r--r--src/lib/libssl/d1_srvr.c11
-rw-r--r--src/lib/libssl/s3_srvr.c11
-rw-r--r--src/lib/libssl/src/ssl/d1_srvr.c11
-rw-r--r--src/lib/libssl/src/ssl/s3_srvr.c11
-rw-r--r--src/lib/libssl/src/ssl/ssl_locl.h8
-rw-r--r--src/lib/libssl/ssl_locl.h8
6 files changed, 42 insertions, 18 deletions
diff --git a/src/lib/libssl/d1_srvr.c b/src/lib/libssl/d1_srvr.c
index ecf4a198b1..6f1d436d18 100644
--- a/src/lib/libssl/d1_srvr.c
+++ b/src/lib/libssl/d1_srvr.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: d1_srvr.c,v 1.33 2014/07/12 22:33:39 jsing Exp $ */ 1/* $OpenBSD: d1_srvr.c,v 1.34 2014/07/28 04:23:12 guenther Exp $ */
2/* 2/*
3 * DTLS implementation written by Nagendra Modadugu 3 * DTLS implementation written by Nagendra Modadugu
4 * (nagendra@cs.stanford.edu) for the OpenSSL project 2005. 4 * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.
@@ -1034,7 +1034,8 @@ dtls1_send_server_key_exchange(SSL *s)
1034 if (type & SSL_kRSA) { 1034 if (type & SSL_kRSA) {
1035 rsa = cert->rsa_tmp; 1035 rsa = cert->rsa_tmp;
1036 if ((rsa == NULL) && (s->cert->rsa_tmp_cb != NULL)) { 1036 if ((rsa == NULL) && (s->cert->rsa_tmp_cb != NULL)) {
1037 rsa = s->cert->rsa_tmp_cb(s, 0, 0); 1037 rsa = s->cert->rsa_tmp_cb(s, 0,
1038 SSL_C_PKEYLENGTH(s->s3->tmp.new_cipher));
1038 if (rsa == NULL) { 1039 if (rsa == NULL) {
1039 al = SSL_AD_HANDSHAKE_FAILURE; 1040 al = SSL_AD_HANDSHAKE_FAILURE;
1040 SSLerr(SSL_F_DTLS1_SEND_SERVER_KEY_EXCHANGE, SSL_R_ERROR_GENERATING_TMP_RSA_KEY); 1041 SSLerr(SSL_F_DTLS1_SEND_SERVER_KEY_EXCHANGE, SSL_R_ERROR_GENERATING_TMP_RSA_KEY);
@@ -1055,7 +1056,8 @@ dtls1_send_server_key_exchange(SSL *s)
1055 if (type & SSL_kDHE) { 1056 if (type & SSL_kDHE) {
1056 dhp = cert->dh_tmp; 1057 dhp = cert->dh_tmp;
1057 if ((dhp == NULL) && (s->cert->dh_tmp_cb != NULL)) 1058 if ((dhp == NULL) && (s->cert->dh_tmp_cb != NULL))
1058 dhp = s->cert->dh_tmp_cb(s, 0, 0); 1059 dhp = s->cert->dh_tmp_cb(s, 0,
1060 SSL_C_PKEYLENGTH(s->s3->tmp.new_cipher));
1059 if (dhp == NULL) { 1061 if (dhp == NULL) {
1060 al = SSL_AD_HANDSHAKE_FAILURE; 1062 al = SSL_AD_HANDSHAKE_FAILURE;
1061 SSLerr(SSL_F_DTLS1_SEND_SERVER_KEY_EXCHANGE, SSL_R_MISSING_TMP_DH_KEY); 1063 SSLerr(SSL_F_DTLS1_SEND_SERVER_KEY_EXCHANGE, SSL_R_MISSING_TMP_DH_KEY);
@@ -1099,7 +1101,8 @@ dtls1_send_server_key_exchange(SSL *s)
1099 1101
1100 ecdhp = cert->ecdh_tmp; 1102 ecdhp = cert->ecdh_tmp;
1101 if (ecdhp == NULL && s->cert->ecdh_tmp_cb != NULL) 1103 if (ecdhp == NULL && s->cert->ecdh_tmp_cb != NULL)
1102 ecdhp = s->cert->ecdh_tmp_cb(s, 0, 0); 1104 ecdhp = s->cert->ecdh_tmp_cb(s, 0,
1105 SSL_C_PKEYLENGTH(s->s3->tmp.new_cipher));
1103 if (ecdhp == NULL) { 1106 if (ecdhp == NULL) {
1104 al = SSL_AD_HANDSHAKE_FAILURE; 1107 al = SSL_AD_HANDSHAKE_FAILURE;
1105 SSLerr(SSL_F_DTLS1_SEND_SERVER_KEY_EXCHANGE, SSL_R_MISSING_TMP_ECDH_KEY); 1108 SSLerr(SSL_F_DTLS1_SEND_SERVER_KEY_EXCHANGE, SSL_R_MISSING_TMP_ECDH_KEY);
diff --git a/src/lib/libssl/s3_srvr.c b/src/lib/libssl/s3_srvr.c
index 8d47a16b55..ed2aaf19b5 100644
--- a/src/lib/libssl/s3_srvr.c
+++ b/src/lib/libssl/s3_srvr.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: s3_srvr.c,v 1.78 2014/07/12 22:33:39 jsing Exp $ */ 1/* $OpenBSD: s3_srvr.c,v 1.79 2014/07/28 04:23:12 guenther Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved. 3 * All rights reserved.
4 * 4 *
@@ -1395,7 +1395,8 @@ ssl3_send_server_key_exchange(SSL *s)
1395 if (type & SSL_kRSA) { 1395 if (type & SSL_kRSA) {
1396 rsa = cert->rsa_tmp; 1396 rsa = cert->rsa_tmp;
1397 if ((rsa == NULL) && (s->cert->rsa_tmp_cb != NULL)) { 1397 if ((rsa == NULL) && (s->cert->rsa_tmp_cb != NULL)) {
1398 rsa = s->cert->rsa_tmp_cb(s, 0, 0); 1398 rsa = s->cert->rsa_tmp_cb(s, 0,
1399 SSL_C_PKEYLENGTH(s->s3->tmp.new_cipher));
1399 if (rsa == NULL) { 1400 if (rsa == NULL) {
1400 al = SSL_AD_HANDSHAKE_FAILURE; 1401 al = SSL_AD_HANDSHAKE_FAILURE;
1401 SSLerr( 1402 SSLerr(
@@ -1419,7 +1420,8 @@ ssl3_send_server_key_exchange(SSL *s)
1419 if (type & SSL_kDHE) { 1420 if (type & SSL_kDHE) {
1420 dhp = cert->dh_tmp; 1421 dhp = cert->dh_tmp;
1421 if ((dhp == NULL) && (s->cert->dh_tmp_cb != NULL)) 1422 if ((dhp == NULL) && (s->cert->dh_tmp_cb != NULL))
1422 dhp = s->cert->dh_tmp_cb(s, 0, 0); 1423 dhp = s->cert->dh_tmp_cb(s, 0,
1424 SSL_C_PKEYLENGTH(s->s3->tmp.new_cipher));
1423 if (dhp == NULL) { 1425 if (dhp == NULL) {
1424 al = SSL_AD_HANDSHAKE_FAILURE; 1426 al = SSL_AD_HANDSHAKE_FAILURE;
1425 SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE, 1427 SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,
@@ -1468,7 +1470,8 @@ ssl3_send_server_key_exchange(SSL *s)
1468 1470
1469 ecdhp = cert->ecdh_tmp; 1471 ecdhp = cert->ecdh_tmp;
1470 if (ecdhp == NULL && s->cert->ecdh_tmp_cb != NULL) 1472 if (ecdhp == NULL && s->cert->ecdh_tmp_cb != NULL)
1471 ecdhp = s->cert->ecdh_tmp_cb(s, 0, 0); 1473 ecdhp = s->cert->ecdh_tmp_cb(s, 0,
1474 SSL_C_PKEYLENGTH(s->s3->tmp.new_cipher));
1472 if (ecdhp == NULL) { 1475 if (ecdhp == NULL) {
1473 al = SSL_AD_HANDSHAKE_FAILURE; 1476 al = SSL_AD_HANDSHAKE_FAILURE;
1474 SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE, 1477 SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,
diff --git a/src/lib/libssl/src/ssl/d1_srvr.c b/src/lib/libssl/src/ssl/d1_srvr.c
index ecf4a198b1..6f1d436d18 100644
--- a/src/lib/libssl/src/ssl/d1_srvr.c
+++ b/src/lib/libssl/src/ssl/d1_srvr.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: d1_srvr.c,v 1.33 2014/07/12 22:33:39 jsing Exp $ */ 1/* $OpenBSD: d1_srvr.c,v 1.34 2014/07/28 04:23:12 guenther Exp $ */
2/* 2/*
3 * DTLS implementation written by Nagendra Modadugu 3 * DTLS implementation written by Nagendra Modadugu
4 * (nagendra@cs.stanford.edu) for the OpenSSL project 2005. 4 * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.
@@ -1034,7 +1034,8 @@ dtls1_send_server_key_exchange(SSL *s)
1034 if (type & SSL_kRSA) { 1034 if (type & SSL_kRSA) {
1035 rsa = cert->rsa_tmp; 1035 rsa = cert->rsa_tmp;
1036 if ((rsa == NULL) && (s->cert->rsa_tmp_cb != NULL)) { 1036 if ((rsa == NULL) && (s->cert->rsa_tmp_cb != NULL)) {
1037 rsa = s->cert->rsa_tmp_cb(s, 0, 0); 1037 rsa = s->cert->rsa_tmp_cb(s, 0,
1038 SSL_C_PKEYLENGTH(s->s3->tmp.new_cipher));
1038 if (rsa == NULL) { 1039 if (rsa == NULL) {
1039 al = SSL_AD_HANDSHAKE_FAILURE; 1040 al = SSL_AD_HANDSHAKE_FAILURE;
1040 SSLerr(SSL_F_DTLS1_SEND_SERVER_KEY_EXCHANGE, SSL_R_ERROR_GENERATING_TMP_RSA_KEY); 1041 SSLerr(SSL_F_DTLS1_SEND_SERVER_KEY_EXCHANGE, SSL_R_ERROR_GENERATING_TMP_RSA_KEY);
@@ -1055,7 +1056,8 @@ dtls1_send_server_key_exchange(SSL *s)
1055 if (type & SSL_kDHE) { 1056 if (type & SSL_kDHE) {
1056 dhp = cert->dh_tmp; 1057 dhp = cert->dh_tmp;
1057 if ((dhp == NULL) && (s->cert->dh_tmp_cb != NULL)) 1058 if ((dhp == NULL) && (s->cert->dh_tmp_cb != NULL))
1058 dhp = s->cert->dh_tmp_cb(s, 0, 0); 1059 dhp = s->cert->dh_tmp_cb(s, 0,
1060 SSL_C_PKEYLENGTH(s->s3->tmp.new_cipher));
1059 if (dhp == NULL) { 1061 if (dhp == NULL) {
1060 al = SSL_AD_HANDSHAKE_FAILURE; 1062 al = SSL_AD_HANDSHAKE_FAILURE;
1061 SSLerr(SSL_F_DTLS1_SEND_SERVER_KEY_EXCHANGE, SSL_R_MISSING_TMP_DH_KEY); 1063 SSLerr(SSL_F_DTLS1_SEND_SERVER_KEY_EXCHANGE, SSL_R_MISSING_TMP_DH_KEY);
@@ -1099,7 +1101,8 @@ dtls1_send_server_key_exchange(SSL *s)
1099 1101
1100 ecdhp = cert->ecdh_tmp; 1102 ecdhp = cert->ecdh_tmp;
1101 if (ecdhp == NULL && s->cert->ecdh_tmp_cb != NULL) 1103 if (ecdhp == NULL && s->cert->ecdh_tmp_cb != NULL)
1102 ecdhp = s->cert->ecdh_tmp_cb(s, 0, 0); 1104 ecdhp = s->cert->ecdh_tmp_cb(s, 0,
1105 SSL_C_PKEYLENGTH(s->s3->tmp.new_cipher));
1103 if (ecdhp == NULL) { 1106 if (ecdhp == NULL) {
1104 al = SSL_AD_HANDSHAKE_FAILURE; 1107 al = SSL_AD_HANDSHAKE_FAILURE;
1105 SSLerr(SSL_F_DTLS1_SEND_SERVER_KEY_EXCHANGE, SSL_R_MISSING_TMP_ECDH_KEY); 1108 SSLerr(SSL_F_DTLS1_SEND_SERVER_KEY_EXCHANGE, SSL_R_MISSING_TMP_ECDH_KEY);
diff --git a/src/lib/libssl/src/ssl/s3_srvr.c b/src/lib/libssl/src/ssl/s3_srvr.c
index 8d47a16b55..ed2aaf19b5 100644
--- a/src/lib/libssl/src/ssl/s3_srvr.c
+++ b/src/lib/libssl/src/ssl/s3_srvr.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: s3_srvr.c,v 1.78 2014/07/12 22:33:39 jsing Exp $ */ 1/* $OpenBSD: s3_srvr.c,v 1.79 2014/07/28 04:23:12 guenther Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved. 3 * All rights reserved.
4 * 4 *
@@ -1395,7 +1395,8 @@ ssl3_send_server_key_exchange(SSL *s)
1395 if (type & SSL_kRSA) { 1395 if (type & SSL_kRSA) {
1396 rsa = cert->rsa_tmp; 1396 rsa = cert->rsa_tmp;
1397 if ((rsa == NULL) && (s->cert->rsa_tmp_cb != NULL)) { 1397 if ((rsa == NULL) && (s->cert->rsa_tmp_cb != NULL)) {
1398 rsa = s->cert->rsa_tmp_cb(s, 0, 0); 1398 rsa = s->cert->rsa_tmp_cb(s, 0,
1399 SSL_C_PKEYLENGTH(s->s3->tmp.new_cipher));
1399 if (rsa == NULL) { 1400 if (rsa == NULL) {
1400 al = SSL_AD_HANDSHAKE_FAILURE; 1401 al = SSL_AD_HANDSHAKE_FAILURE;
1401 SSLerr( 1402 SSLerr(
@@ -1419,7 +1420,8 @@ ssl3_send_server_key_exchange(SSL *s)
1419 if (type & SSL_kDHE) { 1420 if (type & SSL_kDHE) {
1420 dhp = cert->dh_tmp; 1421 dhp = cert->dh_tmp;
1421 if ((dhp == NULL) && (s->cert->dh_tmp_cb != NULL)) 1422 if ((dhp == NULL) && (s->cert->dh_tmp_cb != NULL))
1422 dhp = s->cert->dh_tmp_cb(s, 0, 0); 1423 dhp = s->cert->dh_tmp_cb(s, 0,
1424 SSL_C_PKEYLENGTH(s->s3->tmp.new_cipher));
1423 if (dhp == NULL) { 1425 if (dhp == NULL) {
1424 al = SSL_AD_HANDSHAKE_FAILURE; 1426 al = SSL_AD_HANDSHAKE_FAILURE;
1425 SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE, 1427 SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,
@@ -1468,7 +1470,8 @@ ssl3_send_server_key_exchange(SSL *s)
1468 1470
1469 ecdhp = cert->ecdh_tmp; 1471 ecdhp = cert->ecdh_tmp;
1470 if (ecdhp == NULL && s->cert->ecdh_tmp_cb != NULL) 1472 if (ecdhp == NULL && s->cert->ecdh_tmp_cb != NULL)
1471 ecdhp = s->cert->ecdh_tmp_cb(s, 0, 0); 1473 ecdhp = s->cert->ecdh_tmp_cb(s, 0,
1474 SSL_C_PKEYLENGTH(s->s3->tmp.new_cipher));
1472 if (ecdhp == NULL) { 1475 if (ecdhp == NULL) {
1473 al = SSL_AD_HANDSHAKE_FAILURE; 1476 al = SSL_AD_HANDSHAKE_FAILURE;
1474 SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE, 1477 SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,
diff --git a/src/lib/libssl/src/ssl/ssl_locl.h b/src/lib/libssl/src/ssl/ssl_locl.h
index 34e6337856..3c1c444cb0 100644
--- a/src/lib/libssl/src/ssl/ssl_locl.h
+++ b/src/lib/libssl/src/ssl/ssl_locl.h
@@ -1,4 +1,4 @@
1/* $OpenBSD: ssl_locl.h,v 1.62 2014/07/12 22:33:39 jsing Exp $ */ 1/* $OpenBSD: ssl_locl.h,v 1.63 2014/07/28 04:23:12 guenther Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved. 3 * All rights reserved.
4 * 4 *
@@ -368,6 +368,12 @@
368#define SSL_MEDIUM 0x00000040L 368#define SSL_MEDIUM 0x00000040L
369#define SSL_HIGH 0x00000080L 369#define SSL_HIGH 0x00000080L
370 370
371/*
372 * The keylength (measured in RSA key bits, I guess) for temporary keys.
373 * Cipher argument is so that this can be variable in the future.
374 */
375#define SSL_C_PKEYLENGTH(c) 1024
376
371/* Check if an SSL structure is using DTLS. */ 377/* Check if an SSL structure is using DTLS. */
372#define SSL_IS_DTLS(s) (s->method->ssl3_enc->enc_flags & SSL_ENC_FLAG_DTLS) 378#define SSL_IS_DTLS(s) (s->method->ssl3_enc->enc_flags & SSL_ENC_FLAG_DTLS)
373 379
diff --git a/src/lib/libssl/ssl_locl.h b/src/lib/libssl/ssl_locl.h
index 34e6337856..3c1c444cb0 100644
--- a/src/lib/libssl/ssl_locl.h
+++ b/src/lib/libssl/ssl_locl.h
@@ -1,4 +1,4 @@
1/* $OpenBSD: ssl_locl.h,v 1.62 2014/07/12 22:33:39 jsing Exp $ */ 1/* $OpenBSD: ssl_locl.h,v 1.63 2014/07/28 04:23:12 guenther Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved. 3 * All rights reserved.
4 * 4 *
@@ -368,6 +368,12 @@
368#define SSL_MEDIUM 0x00000040L 368#define SSL_MEDIUM 0x00000040L
369#define SSL_HIGH 0x00000080L 369#define SSL_HIGH 0x00000080L
370 370
371/*
372 * The keylength (measured in RSA key bits, I guess) for temporary keys.
373 * Cipher argument is so that this can be variable in the future.
374 */
375#define SSL_C_PKEYLENGTH(c) 1024
376
371/* Check if an SSL structure is using DTLS. */ 377/* Check if an SSL structure is using DTLS. */
372#define SSL_IS_DTLS(s) (s->method->ssl3_enc->enc_flags & SSL_ENC_FLAG_DTLS) 378#define SSL_IS_DTLS(s) (s->method->ssl3_enc->enc_flags & SSL_ENC_FLAG_DTLS)
373 379
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-23 17:42:02 +0000