commit 1028b74cff9607cdbcd3635378bb90a7c7a6153e
author Manuel Pégourié-Gonnard <mpg@elzevir.fr> Wed May 06 17:33:07 2015 +0100
committer Manuel Pégourié-Gonnard <mpg@elzevir.fr> Mon May 11 12:33:27 2015 +0200
tree 8c76e294ef663e8280703d25e0b0317344d82e75
parent 8836994f6b9527f5565d38d758709a3ac8797550

Upgrade default DHM params size

library/ssl_tls.c

diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index 229536d..114f5ae 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -5400,11 +5400,13 @@
 {
     int ret;
 
-    if( ( ret = mbedtls_mpi_read_string( &conf->dhm_P, 16, dhm_P ) ) != 0 )
+    if( ( ret = mbedtls_mpi_read_string( &conf->dhm_P, 16, dhm_P ) ) != 0 ||
+        ( ret = mbedtls_mpi_read_string( &conf->dhm_G, 16, dhm_G ) ) != 0 )
+    {
+        mbedtls_mpi_free( &conf->dhm_P );
+        mbedtls_mpi_free( &conf->dhm_G );
         return( ret );
-
-    if( ( ret = mbedtls_mpi_read_string( &conf->dhm_G, 16, dhm_G ) ) != 0 )
-        return( ret );
+    }
 
     return( 0 );
 }
@@ -5413,11 +5415,13 @@
 {
     int ret;
 
-    if( ( ret = mbedtls_mpi_copy( &conf->dhm_P, &dhm_ctx->P ) ) != 0 )
+    if( ( ret = mbedtls_mpi_copy( &conf->dhm_P, &dhm_ctx->P ) ) != 0 ||
+        ( ret = mbedtls_mpi_copy( &conf->dhm_G, &dhm_ctx->G ) ) != 0 )
+    {
+        mbedtls_mpi_free( &conf->dhm_P );
+        mbedtls_mpi_free( &conf->dhm_G );
         return( ret );
-
-    if( ( ret = mbedtls_mpi_copy( &conf->dhm_G, &dhm_ctx->G ) ) != 0 )
-        return( ret );
+    }
 
     return( 0 );
 }
@@ -6667,15 +6671,15 @@
     conf->renego_period[7] = 0x00;
 #endif
 
-#if defined(MBEDTLS_DHM_C)
-    if( ( ret = mbedtls_mpi_read_string( &conf->dhm_P, 16,
-                                 MBEDTLS_DHM_RFC5114_MODP_1024_P) ) != 0 ||
-        ( ret = mbedtls_mpi_read_string( &conf->dhm_G, 16,
-                                 MBEDTLS_DHM_RFC5114_MODP_1024_G) ) != 0 )
+#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
+    if( endpoint == MBEDTLS_SSL_IS_SERVER )
     {
-        mbedtls_mpi_free( &conf->dhm_P );
-        mbedtls_mpi_free( &conf->dhm_G );
-        return( ret );
+        if( ( ret = mbedtls_ssl_set_dh_param( conf,
+                        MBEDTLS_DHM_RFC5114_MODP_2048_P,
+                        MBEDTLS_DHM_RFC5114_MODP_2048_G ) ) != 0 )
+        {
+            return( ret );
+        }
     }
 #endif