diff options
| author |   jsing <jsing@openbsd.org> | 2014-06-13 16:09:15 +0000 |
|---|---|---|
| committer | jsing <jsing@openbsd.org> | 2014-06-13 16:09:15 +0000 |
| commit | 6d683b63717ec733bbd46ddddc0ae14d1d1c3b2d (patch) | |
| tree | 201ac7f136e7a404ce31b384a06ec8c2954ba1e1 /lib/libssl/src | |
| parent | Overhaul the keyblock handling in ssl3_change_cipher_state(). Use (diff) | |
| download | wireguard-openbsd-6d683b63717ec733bbd46ddddc0ae14d1d1c3b2d.tar.xz wireguard-openbsd-6d683b63717ec733bbd46ddddc0ae14d1d1c3b2d.zip | |
Correctly calculate the key block length when using export ciphers.
Diffstat (limited to 'lib/libssl/src')
| -rw-r--r-- | lib/libssl/src/ssl/t1_enc.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/lib/libssl/src/ssl/t1_enc.c b/lib/libssl/src/ssl/t1_enc.c index 7b6c9b7ac68..fe8ccab23e7 100644 --- a/lib/libssl/src/ssl/t1_enc.c +++ b/lib/libssl/src/ssl/t1_enc.c @@ -1,4 +1,4 @@ -/* $OpenBSD: t1_enc.c,v 1.58 2014/06/13 14:32:35 jsing Exp $ */ +/* $OpenBSD: t1_enc.c,v 1.59 2014/06/13 16:09:15 jsing Exp $ */ /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) * All rights reserved. * @@ -697,6 +697,10 @@ tls1_setup_key_block(SSL *s) key_len = EVP_CIPHER_key_length(cipher); iv_len = EVP_CIPHER_iv_length(cipher); + if (SSL_C_IS_EXPORT(s->session->cipher) && + key_len > SSL_C_EXPORT_KEYLENGTH(s->session->cipher)) + key_len = SSL_C_EXPORT_KEYLENGTH(s->session->cipher); + /* If GCM mode only part of IV comes from PRF. */ if (EVP_CIPHER_mode(cipher) == EVP_CIPH_GCM_MODE) iv_len = EVP_GCM_TLS_FIXED_IV_LEN; |