diff options
| author |   jsing <jsing@openbsd.org> | 2014-10-15 14:02:16 +0000 |
|---|---|---|
| committer | jsing <jsing@openbsd.org> | 2014-10-15 14:02:16 +0000 |
| commit | a616f9ba447927ec530a4294d62a0eea8b9a3356 (patch) | |
| tree | 77e24038f9641e0bb7b1b3f0a989059580d5ff2b /lib/libssl/src | |
| parent | Add cipher aliases for DHE (the correct name for EDH) and ECDHE (the (diff) | |
| download | wireguard-openbsd-a616f9ba447927ec530a4294d62a0eea8b9a3356.tar.xz wireguard-openbsd-a616f9ba447927ec530a4294d62a0eea8b9a3356.zip | |
Only require an EC public key in tls1_set_ec_id(), if we need to provide
a compression identifier. In the case of a server using ephemeral EC keys,
the supplied key is unlikely to have a public key where
SSL_CTX_set_tmp_ecdh() is called after SSL_OP_SINGLE_ECDH_USE has been
set. This makes ECDHE ciphers work again for this use case.
Diffstat (limited to 'lib/libssl/src')
| -rw-r--r-- | lib/libssl/src/ssl/t1_lib.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/lib/libssl/src/ssl/t1_lib.c b/lib/libssl/src/ssl/t1_lib.c index 409da9b4bdf..22e84fe1223 100644 --- a/lib/libssl/src/ssl/t1_lib.c +++ b/lib/libssl/src/ssl/t1_lib.c @@ -1,4 +1,4 @@ -/* $OpenBSD: t1_lib.c,v 1.63 2014/10/05 14:56:32 jsing Exp $ */ +/* $OpenBSD: t1_lib.c,v 1.64 2014/10/15 14:02:16 jsing Exp $ */ /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) * All rights reserved. * @@ -458,9 +458,6 @@ tls1_set_ec_id(unsigned char *curve_id, unsigned char *comp_id, EC_KEY *ec) if (ec == NULL) return (0); - if (EC_KEY_get0_public_key(ec) == NULL) - return (0); - /* Determine if it is a prime field. */ if ((grp = EC_KEY_get0_group(ec)) == NULL) return (0); @@ -484,6 +481,9 @@ tls1_set_ec_id(unsigned char *curve_id, unsigned char *comp_id, EC_KEY *ec) /* Specify the compression identifier. */ if (comp_id != NULL) { + if (EC_KEY_get0_public_key(ec) == NULL) + return (0); + if (EC_KEY_get_conv_form(ec) == POINT_CONVERSION_COMPRESSED) { *comp_id = is_prime ? TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime : |