GitLab/ocserv
1
0
Fork 0
mirror of https://gitlab.com/openconnect/ocserv.git synced 2026-02-10 00:37:00 +08:00
Code Issues Packages Projects Releases Wiki Activity

when selecting a DTLS ciphersuite try to ensure it matches the CSTP

Browse Source
This commit is contained in:
Nikos Mavrogiannopoulos
2014-10-27 11:03:38 +01:00
parent f0871989a8
commit be2c8b3cc5
1 changed files with 23 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
src/worker-vpn.c
View File

@@ -233,6 +233,9 @@ static void value_check(struct worker_st *ws, struct http_req_st *req)
size_t nlen, value_length;
char *token, *value;
char *str, *p;
const dtls_ciphersuite_st *cand = NULL;
gnutls_cipher_algorithm_t want_cipher;
gnutls_mac_algorithm_t want_mac;
if (req->value.length <= 0)
return;
@@ -296,6 +299,14 @@ static void value_check(struct worker_st *ws, struct http_req_st *req)
break;
case HEADER_DTLS_CIPHERSUITE:
if (ws->session != NULL) {
want_mac = gnutls_mac_get(ws->session);
want_cipher = gnutls_cipher_get(ws->session);
} else {
want_mac = -1;
want_cipher = -1;
}
req->selected_ciphersuite = NULL;
str = (char *)value;
@@ -304,17 +315,25 @@ static void value_check(struct worker_st *ws, struct http_req_st *req)
i < sizeof(ciphersuites) / sizeof(ciphersuites[0]);
i++) {
if (strcmp(token, ciphersuites[i].oc_name) == 0) {
if (req->selected_ciphersuite == NULL ||
req->
selected_ciphersuite->server_prio <
if (cand == NULL ||
cand->server_prio <
ciphersuites[i].server_prio) {
req->selected_ciphersuite =
cand =
&ciphersuites[i];
/* if our candidate matches the TLS session
* ciphersuite, we are finished */
if (want_cipher != -1) {
if (want_cipher == cand->gnutls_cipher &&
want_mac == cand->gnutls_mac)
break;
}
}
}
}
str = NULL;
}
req->selected_ciphersuite = cand;
break;