There are a couple of typos in s3_srvr.c where a logical "|" should be "&"
where it decides if the temp key generation callback should produce an
export key or full strength key. The typo occurs twice - once in the RSA
code and again in the DH code.
There's also a bug where if the DH parameters in the cert are null pointers
it'll call DH_generate_key(), but if that call fails it'll go ahead and try
to dereference the null pointers anyway (causing a core dump).
This patch fixes both bugs. With this change and appropriate tweaks in Tim's
SSLftp-0.13 and SSLtelnet-0.13, I'm using self-signed DSA-DH server certs.
BTW, how about allowing non-subscribers to post to openssl-dev so I can
send in diffs anonymously. Or open it up to remailers maybe?
*** s3_srvr.c.orig Mon Dec 21 04:00:06 1998
--- s3_srvr.c Tue Jan 5 22:26:47 1999
***************
*** 916,920 ****
{
rsa=s->ctx->default_cert->rsa_tmp_cb(s,
! (s->s3->tmp.new_cipher->algorithms|
SSL_NOT_EXP)?0:1);
CRYPTO_add(&rsa->references,1,CRYPTO_LOCK_RSA);
--- 916,920 ----
{
rsa=s->ctx->default_cert->rsa_tmp_cb(s,
! (s->s3->tmp.new_cipher->algorithms&
SSL_NOT_EXP)?0:1);
CRYPTO_add(&rsa->references,1,CRYPTO_LOCK_RSA);
***************
*** 939,943 ****
if ((dhp == NULL) && (cert->dh_tmp_cb != NULL))
dhp=cert->dh_tmp_cb(s,
! (s->s3->tmp.new_cipher->algorithms|
SSL_NOT_EXP)?0:1);
if (dhp == NULL)
--- 939,943 ----
if ((dhp == NULL) && (cert->dh_tmp_cb != NULL))
dhp=cert->dh_tmp_cb(s,
! (s->s3->tmp.new_cipher->algorithms&
SSL_NOT_EXP)?0:1);
if (dhp == NULL)
***************
*** 954,964 ****
s->s3->tmp.dh=dh;
! if (((dhp->pub_key == NULL) ||
(dhp->priv_key == NULL) ||
! (s->options & SSL_OP_SINGLE_DH_USE)) &&
! (!DH_generate_key(dh)))
{
!
SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_R_DH_LIB);
! goto err;
}
else
--- 954,966 ----
s->s3->tmp.dh=dh;
! if ((dhp->pub_key == NULL) ||
(dhp->priv_key == NULL) ||
! (s->options & SSL_OP_SINGLE_DH_USE))
{
! if (!DH_generate_key(dh))
! {
!
SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_R_DH_LIB);
! goto err;
! }
}
else
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
