diff options
| author | Emilia Käsper <emilia@openssl.org> | 2014-07-24 22:15:29 +0200 |
|---|---|---|
| committer | Matt Caswell <matt@openssl.org> | 2014-08-06 20:27:51 +0100 |
| commit | 88ae012c8092852f03c50f6461175271104b4c8a (patch) | |
| tree | 89eef0140a2e1b491b91576731e8813d8191660c /ssl/d1_clnt.c | |
| parent | fc4f4cdb8bf9981904e652abf69b892a45bddacf (diff) | |
Fix DTLS anonymous EC(DH) denial of service
CVE-2014-3510
Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
Diffstat (limited to 'ssl/d1_clnt.c')
| -rw-r--r-- | ssl/d1_clnt.c | 23 |
1 files changed, 21 insertions, 2 deletions
diff --git a/ssl/d1_clnt.c b/ssl/d1_clnt.c index 65dbb4aba9..fd6562c114 100644 --- a/ssl/d1_clnt.c +++ b/ssl/d1_clnt.c @@ -996,6 +996,13 @@ int dtls1_send_client_key_exchange(SSL *s) RSA *rsa; unsigned char tmp_buf[SSL_MAX_MASTER_KEY_LENGTH]; + if (s->session->sess_cert == NULL) + { + /* We should always have a server certificate with SSL_kRSA. */ + SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,ERR_R_INTERNAL_ERROR); + goto err; + } + if (s->session->sess_cert->peer_rsa_tmp != NULL) rsa=s->session->sess_cert->peer_rsa_tmp; else @@ -1186,6 +1193,13 @@ int dtls1_send_client_key_exchange(SSL *s) { DH *dh_srvr,*dh_clnt; + if (s->session->sess_cert == NULL) + { + ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_UNEXPECTED_MESSAGE); + SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,SSL_R_UNEXPECTED_MESSAGE); + goto err; + } + if (s->session->sess_cert->peer_dh_tmp != NULL) dh_srvr=s->session->sess_cert->peer_dh_tmp; else @@ -1245,6 +1259,13 @@ int dtls1_send_client_key_exchange(SSL *s) int ecdh_clnt_cert = 0; int field_size = 0; + if (s->session->sess_cert == NULL) + { + ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_UNEXPECTED_MESSAGE); + SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,SSL_R_UNEXPECTED_MESSAGE); + goto err; + } + /* Did we send out the client's * ECDH share for use in premaster * computation as part of client certificate? @@ -1720,5 +1741,3 @@ int dtls1_send_client_certificate(SSL *s) /* SSL3_ST_CW_CERT_D */ return(dtls1_do_write(s,SSL3_RT_HANDSHAKE)); } - - |