diff options
| author |   jsing <jsing@openbsd.org> | 2014-10-31 15:25:55 +0000 |
|---|---|---|
| committer | jsing <jsing@openbsd.org> | 2014-10-31 15:25:55 +0000 |
| commit | 95986511df7e213592f431d31c873ef1468ac940 (patch) | |
| tree | b763b8049dfe7b6d29298e8e146a7f9a52697865 /lib/libssl/s3_srvr.c | |
| parent | Even in interrupt context curproc is not NULL. (diff) | |
| download | wireguard-openbsd-95986511df7e213592f431d31c873ef1468ac940.tar.xz wireguard-openbsd-95986511df7e213592f431d31c873ef1468ac940.zip | |
Add support for automatic DH ephemeral keys.
This allows an SSL server to enable DHE ciphers with a single setting,
which results in an DH key being generated based on the server key length.
Partly based on OpenSSL.
Diffstat (limited to 'lib/libssl/s3_srvr.c')
| -rw-r--r-- | lib/libssl/s3_srvr.c | 21 |
1 files changed, 17 insertions, 4 deletions
diff --git a/lib/libssl/s3_srvr.c b/lib/libssl/s3_srvr.c index 1b97895f76f..3a311fbfb6b 100644 --- a/lib/libssl/s3_srvr.c +++ b/lib/libssl/s3_srvr.c @@ -1,4 +1,4 @@ -/* $OpenBSD: s3_srvr.c,v 1.88 2014/10/31 14:51:01 jsing Exp $ */ +/* $OpenBSD: s3_srvr.c,v 1.89 2014/10/31 15:25:55 jsing Exp $ */ /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) * All rights reserved. * @@ -1360,10 +1360,21 @@ ssl3_send_server_key_exchange(SSL *s) r[0] = r[1] = r[2] = r[3] = NULL; n = 0; if (type & SSL_kDHE) { - dhp = cert->dh_tmp; - if ((dhp == NULL) && (s->cert->dh_tmp_cb != NULL)) + if (s->cert->dh_tmp_auto != 0) { + if ((dhp = ssl_get_auto_dh(s)) == NULL) { + al = SSL_AD_INTERNAL_ERROR; + SSLerr( + SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE, + ERR_R_INTERNAL_ERROR); + goto f_err; + } + } else + dhp = cert->dh_tmp; + + if (dhp == NULL && s->cert->dh_tmp_cb != NULL) dhp = s->cert->dh_tmp_cb(s, 0, SSL_C_PKEYLENGTH(s->s3->tmp.new_cipher)); + if (dhp == NULL) { al = SSL_AD_HANDSHAKE_FAILURE; SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE, @@ -1377,7 +1388,9 @@ ssl3_send_server_key_exchange(SSL *s) goto err; } - if ((dh = DHparams_dup(dhp)) == NULL) { + if (s->cert->dh_tmp_auto != 0) { + dh = dhp; + } else if ((dh = DHparams_dup(dhp)) == NULL) { SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE, ERR_R_DH_LIB); goto err; |