diff options
| author | Jack Lloyd <[email protected]> | 2017-11-26 20:54:12 -0500 |
|---|---|---|
| committer | Jack Lloyd <[email protected]> | 2017-11-26 20:54:12 -0500 |
| commit | d2f84e5670df96dc2f8e15b7fd5cd7cc32ca7283 (patch) | |
| tree | 405f760c63e8a56e6a005f566289c6caa0ba1585 /src/lib/tls/tls_server.cpp | |
| parent | 37bfb85f612ad380686540f50c6fc5d3d3cccbc7 (diff) | |
Fix errors caught with tlsfuzzer
Don't send EC point format extension in server hello unless an EC
suite was negotiated *and* the client sent the extension.
Fix server FFDHE logic, this effectively disabled DHE ciphersuites
for clients without FFDHE extension.
Use unexpected_message alert in case of an unexpected message.
(Previously an internal_error alert was sent.)
Diffstat (limited to 'src/lib/tls/tls_server.cpp')
| -rw-r--r-- | src/lib/tls/tls_server.cpp | 7 |
1 files changed, 0 insertions, 7 deletions
diff --git a/src/lib/tls/tls_server.cpp b/src/lib/tls/tls_server.cpp index 9f1dfe1d1..f20e363cf 100644 --- a/src/lib/tls/tls_server.cpp +++ b/src/lib/tls/tls_server.cpp @@ -168,13 +168,9 @@ uint16_t choose_ciphersuite( const bool have_shared_ecc_curve = (policy.choose_curve(client_hello.supported_ecc_curves()) != ""); - const bool have_shared_dh_group = - (policy.choose_dh_group(client_hello.supported_dh_groups()) != ""); - /* Walk down one list in preference order */ - std::vector<uint16_t> pref_list = server_suites; std::vector<uint16_t> other_list = client_suites; @@ -196,9 +192,6 @@ uint16_t choose_ciphersuite( if(suite.ecc_ciphersuite() && have_shared_ecc_curve == false) continue; - if(suite.kex_algo() == "DH" && have_shared_dh_group == false) - continue; - // For non-anon ciphersuites if(suite.sig_algo() != "") { |