diff options
| author | Yves-Alexis Perez <corsac@debian.org> | 2015-06-01 14:46:30 +0200 |
|---|---|---|
| committer | Yves-Alexis Perez <corsac@debian.org> | 2015-06-01 14:46:30 +0200 |
| commit | fc556ec2bc92a9d476c11406fad2c33db8bf7cb0 (patch) | |
| tree | 7360889e50de867d72741213d534a756c73902c8 /src/libtls | |
| parent | 83b8aebb19fe6e49e13a05d4e8f5ab9a06177642 (diff) | |
| download | vyos-strongswan-fc556ec2bc92a9d476c11406fad2c33db8bf7cb0.tar.gz vyos-strongswan-fc556ec2bc92a9d476c11406fad2c33db8bf7cb0.zip | |
Imported Upstream version 5.3.1
Diffstat (limited to 'src/libtls')
| -rw-r--r-- | src/libtls/tls_peer.c | 9 | ||||
| -rw-r--r-- | src/libtls/tls_server.c | 2 |
2 files changed, 9 insertions, 2 deletions
diff --git a/src/libtls/tls_peer.c b/src/libtls/tls_peer.c index e6be36b7b..000dda43b 100644 --- a/src/libtls/tls_peer.c +++ b/src/libtls/tls_peer.c @@ -354,6 +354,13 @@ static status_t process_modp_key_exchange(private_tls_peer_t *this, this->alert->add(this->alert, TLS_FATAL, TLS_DECODE_ERROR); return NEED_MORE; } + /* reject (export) DH groups using primes smaller than 1024 bit */ + if (prime.len < 1024 / 8) + { + DBG1(DBG_TLS, "short DH prime received (%zu bytes)", prime.len); + this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR); + return NEED_MORE; + } public = find_public_key(this); if (!public) { @@ -641,7 +648,7 @@ static status_t process_finished(private_tls_peer_t *this, bio_reader_t *reader) this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR); return NEED_MORE; } - if (!chunk_equals(received, chunk_from_thing(buf))) + if (!chunk_equals_const(received, chunk_from_thing(buf))) { DBG1(DBG_TLS, "received server finished invalid"); this->alert->add(this->alert, TLS_FATAL, TLS_DECRYPT_ERROR); diff --git a/src/libtls/tls_server.c b/src/libtls/tls_server.c index b1a214f7f..f9295a160 100644 --- a/src/libtls/tls_server.c +++ b/src/libtls/tls_server.c @@ -607,7 +607,7 @@ static status_t process_finished(private_tls_server_t *this, this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR); return NEED_MORE; } - if (!chunk_equals(received, chunk_from_thing(buf))) + if (!chunk_equals_const(received, chunk_from_thing(buf))) { DBG1(DBG_TLS, "received client finished invalid"); this->alert->add(this->alert, TLS_FATAL, TLS_DECRYPT_ERROR); |