From 0da99f89c646309c2093dbe094b8dc7d568cdfd7 Mon Sep 17 00:00:00 2001
From: jsing <>
Date: Fri, 31 Oct 2014 15:25:55 +0000
Subject: Add support for automatic DH ephemeral keys.

This allows an SSL server to enable DHE ciphers with a single setting,
which results in an DH key being generated based on the server key length.

Partly based on OpenSSL.
---
 src/lib/libssl/s3_srvr.c | 21 +++++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

(limited to 'src/lib/libssl/s3_srvr.c')

diff --git a/src/lib/libssl/s3_srvr.c b/src/lib/libssl/s3_srvr.c
index 1b97895f76..3a311fbfb6 100644
--- a/src/lib/libssl/s3_srvr.c
+++ b/src/lib/libssl/s3_srvr.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: s3_srvr.c,v 1.88 2014/10/31 14:51:01 jsing Exp $ */
+/* $OpenBSD: s3_srvr.c,v 1.89 2014/10/31 15:25:55 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -1360,10 +1360,21 @@ ssl3_send_server_key_exchange(SSL *s)
 		r[0] = r[1] = r[2] = r[3] = NULL;
 		n = 0;
 		if (type & SSL_kDHE) {
-			dhp = cert->dh_tmp;
-			if ((dhp == NULL) && (s->cert->dh_tmp_cb != NULL))
+			if (s->cert->dh_tmp_auto != 0) {
+				if ((dhp = ssl_get_auto_dh(s)) == NULL) {
+					al = SSL_AD_INTERNAL_ERROR;
+					SSLerr(
+					    SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,
+					    ERR_R_INTERNAL_ERROR);
+					goto f_err;
+				}
+			} else
+				dhp = cert->dh_tmp;
+
+			if (dhp == NULL && s->cert->dh_tmp_cb != NULL)
 				dhp = s->cert->dh_tmp_cb(s, 0,
 				    SSL_C_PKEYLENGTH(s->s3->tmp.new_cipher));
+
 			if (dhp == NULL) {
 				al = SSL_AD_HANDSHAKE_FAILURE;
 				SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,
@@ -1377,7 +1388,9 @@ ssl3_send_server_key_exchange(SSL *s)
 				goto err;
 			}
 
-			if ((dh = DHparams_dup(dhp)) == NULL) {
+			if (s->cert->dh_tmp_auto != 0) {
+				dh = dhp;
+			} else if ((dh = DHparams_dup(dhp)) == NULL) {
 				SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,
 				    ERR_R_DH_LIB);
 				goto err;
-- 
cgit v1.2.3-55-g6feb