From fc556ec2bc92a9d476c11406fad2c33db8bf7cb0 Mon Sep 17 00:00:00 2001 From: Yves-Alexis Perez Date: Mon, 1 Jun 2015 14:46:30 +0200 Subject: Imported Upstream version 5.3.1 --- src/libtls/tls_peer.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) (limited to 'src/libtls/tls_peer.c') diff --git a/src/libtls/tls_peer.c b/src/libtls/tls_peer.c index e6be36b7b..000dda43b 100644 --- a/src/libtls/tls_peer.c +++ b/src/libtls/tls_peer.c @@ -354,6 +354,13 @@ static status_t process_modp_key_exchange(private_tls_peer_t *this, this->alert->add(this->alert, TLS_FATAL, TLS_DECODE_ERROR); return NEED_MORE; } + /* reject (export) DH groups using primes smaller than 1024 bit */ + if (prime.len < 1024 / 8) + { + DBG1(DBG_TLS, "short DH prime received (%zu bytes)", prime.len); + this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR); + return NEED_MORE; + } public = find_public_key(this); if (!public) { @@ -641,7 +648,7 @@ static status_t process_finished(private_tls_peer_t *this, bio_reader_t *reader) this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR); return NEED_MORE; } - if (!chunk_equals(received, chunk_from_thing(buf))) + if (!chunk_equals_const(received, chunk_from_thing(buf))) { DBG1(DBG_TLS, "received server finished invalid"); this->alert->add(this->alert, TLS_FATAL, TLS_DECRYPT_ERROR); -- cgit v1.2.3