Bommels05/Mozilla
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 587234: Better error reporting for tiny DH keys in Server Key Exchange.

Browse Source 
Add a new error code SSL_ERROR_WEAK_SERVER_KEY for the dh_p size check in
ssl3_HandleServerKeyExchange.  r=nelson.
Modified Files:
 Tag: NSS_3_12_BRANCH
	cmd/lib/SSLerrs.h lib/ssl/ssl3con.c lib/ssl/sslerr.h


git-svn-id: svn://10.0.0.236/branches/NSS_3_12_BRANCH@261050 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
wtc%google.com
2010-08-16 18:21:19 +00:00
parent ee207c91be
commit b6352130da
3 changed files with 10 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
mozilla/security/nss/cmd/lib/SSLerrs.h
View File

@@ -402,3 +402,6 @@ ER3(SSL_ERROR_UNSAFE_NEGOTIATION, (SSL_ERROR_BASE + 113),
ER3(SSL_ERROR_RX_UNEXPECTED_UNCOMPRESSED_RECORD, (SSL_ERROR_BASE + 114),
"SSL received an unexpected uncompressed record.")
ER3(SSL_ERROR_WEAK_SERVER_KEY, (SSL_ERROR_BASE + 115),
"SSL received a weak key in Server Key Exchange handshake message.")

6
mozilla/security/nss/lib/ssl/ssl3con.c
View File

@@ -39,7 +39,7 @@
* the terms of any one of the MPL, the GPL or the LGPL.
*
* ***** END LICENSE BLOCK ***** */
/* $Id: ssl3con.c,v 1.142.2.1 2010-07-31 04:33:52 wtc%google.com Exp $ */
/* $Id: ssl3con.c,v 1.142.2.2 2010-08-16 18:21:19 wtc%google.com Exp $ */
#include "cert.h"
#include "ssl.h"
@@ -5302,8 +5302,10 @@ ssl3_HandleServerKeyExchange(sslSocket *ss, SSL3Opaque *b, PRUint32 length)
if (rv != SECSuccess) {
goto loser; /* malformed. */
}
if (dh_p.len < 512/8)
if (dh_p.len < 512/8) {
errCode = SSL_ERROR_WEAK_SERVER_KEY;
goto alert_loser;
}
rv = ssl3_ConsumeHandshakeVariable(ss, &dh_g, 2, &b, &length);
if (rv != SECSuccess) {
goto loser; /* malformed. */

4
mozilla/security/nss/lib/ssl/sslerr.h
View File

@@ -36,7 +36,7 @@
* the terms of any one of the MPL, the GPL or the LGPL.
*
* ***** END LICENSE BLOCK ***** */
/* $Id: sslerr.h,v 1.11 2010-06-24 09:24:18 nelson%bolyard.com Exp $ */
/* $Id: sslerr.h,v 1.11.2.1 2010-08-16 18:21:19 wtc%google.com Exp $ */
#ifndef __SSL_ERR_H_
#define __SSL_ERR_H_
@@ -201,6 +201,8 @@ SSL_ERROR_UNSAFE_NEGOTIATION = (SSL_ERROR_BASE + 113),
SSL_ERROR_RX_UNEXPECTED_UNCOMPRESSED_RECORD = (SSL_ERROR_BASE + 114),
SSL_ERROR_WEAK_SERVER_KEY = (SSL_ERROR_BASE + 115),
SSL_ERROR_END_OF_LIST /* let the c compiler determine the value of this. */
} SSLErrorCodes;
#endif /* NO_SECURITY_ERROR_ENUM */