|
 |
adf540 |
commit eacd5798a5d83e6658a823c01bcb0f600e3b9898
|
|
|
adf540 |
Author: Howard Chu <hyc@openldap.org>
|
|
|
adf540 |
Date: Sat Sep 7 06:39:53 2013 -0700
|
|
|
adf540 |
|
|
|
adf540 |
ITS#7506 fix prev commit
|
|
|
adf540 |
|
|
|
adf540 |
The patch unconditionally enabled DHparams, which is a significant
|
|
|
adf540 |
change of behavior. Reverting to previous behavior, which only enables
|
|
|
adf540 |
DH use if a DHparam file was configured.
|
|
|
adf540 |
|
|
|
adf540 |
diff --git a/libraries/libldap/tls_o.c b/libraries/libldap/tls_o.c
|
|
|
adf540 |
index c6a3540c9..a2d9cd31f 100644
|
|
|
adf540 |
--- a/libraries/libldap/tls_o.c
|
|
|
adf540 |
+++ b/libraries/libldap/tls_o.c
|
|
|
adf540 |
@@ -59,14 +59,6 @@ static int tlso_verify_cb( int ok, X509_STORE_CTX *ctx );
|
|
|
adf540 |
static int tlso_verify_ok( int ok, X509_STORE_CTX *ctx );
|
|
|
adf540 |
static RSA * tlso_tmp_rsa_cb( SSL *ssl, int is_export, int key_length );
|
|
|
adf540 |
|
|
|
adf540 |
-/* From the OpenSSL 0.9.7 distro */
|
|
|
adf540 |
-static const char tlso_dhpem1024[] =
|
|
|
adf540 |
-"-----BEGIN DH PARAMETERS-----\n\
|
|
|
adf540 |
-MIGHAoGBAJf2QmHKtQXdKCjhPx1ottPb0PMTBH9A6FbaWMsTuKG/K3g6TG1Z1fkq\n\
|
|
|
adf540 |
-/Gz/PWk/eLI9TzFgqVAuPvr3q14a1aZeVUMTgo2oO5/y2UHe6VaJ+trqCTat3xlx\n\
|
|
|
adf540 |
-/mNbIK9HA2RgPC3gWfVLZQrY+gz3ASHHR5nXWHEyvpuZm7m3h+irAgEC\n\
|
|
|
adf540 |
------END DH PARAMETERS-----\n";
|
|
|
adf540 |
-
|
|
|
adf540 |
static int tlso_seed_PRNG( const char *randfile );
|
|
|
adf540 |
|
|
|
adf540 |
#ifdef LDAP_R_COMPILE
|
|
|
adf540 |
@@ -304,21 +296,17 @@ tlso_ctx_init( struct ldapoptions *lo, struct ldaptls *lt, int is_server )
|
|
|
adf540 |
return -1;
|
|
|
adf540 |
}
|
|
|
adf540 |
|
|
|
adf540 |
- if (is_server) {
|
|
|
adf540 |
+ if ( lo->ldo_tls_dhfile ) {
|
|
|
adf540 |
DH *dh = NULL;
|
|
|
adf540 |
BIO *bio;
|
|
|
adf540 |
SSL_CTX_set_options( ctx, SSL_OP_SINGLE_DH_USE );
|
|
|
adf540 |
- if ( lo->ldo_tls_dhfile ) {
|
|
|
adf540 |
|
|
|
adf540 |
- if (( bio=BIO_new_file( lt->lt_dhfile,"r" )) == NULL ) {
|
|
|
adf540 |
- Debug( LDAP_DEBUG_ANY,
|
|
|
adf540 |
- "TLS: could not use DH parameters file `%s'.\n",
|
|
|
adf540 |
- lo->ldo_tls_dhfile,0,0);
|
|
|
adf540 |
- tlso_report_error();
|
|
|
adf540 |
- return -1;
|
|
|
adf540 |
- }
|
|
|
adf540 |
- } else {
|
|
|
adf540 |
- bio = BIO_new_mem_buf( tlso_dhpem1024, -1 );
|
|
|
adf540 |
+ if (( bio=BIO_new_file( lt->lt_dhfile,"r" )) == NULL ) {
|
|
|
adf540 |
+ Debug( LDAP_DEBUG_ANY,
|
|
|
adf540 |
+ "TLS: could not use DH parameters file `%s'.\n",
|
|
|
adf540 |
+ lo->ldo_tls_dhfile,0,0);
|
|
|
adf540 |
+ tlso_report_error();
|
|
|
adf540 |
+ return -1;
|
|
|
adf540 |
}
|
|
|
adf540 |
if (!( dh=PEM_read_bio_DHparams( bio, NULL, NULL, NULL ))) {
|
|
|
adf540 |
Debug( LDAP_DEBUG_ANY,
|