- provos@cvs.openbsd.org 2001/03/27 17:46:50

     [compat.c compat.h dh.c dh.h ssh2.h sshconnect2.c sshd.c version.h]
     make dh group exchange more flexible, allow min and max group size,
     okay markus@, deraadt@

1 files changed, 13 insertions, 6 deletions

diff --git a/dh.c b/dh.c
index ac73f8400..5f441ee1c 100644
--- a/dh.c
+++ b/dh.c
@@ -23,7 +23,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: dh.c,v 1.8 2001/03/05 17:58:22 stevesk Exp $");
+RCSID("$OpenBSD: dh.c,v 1.9 2001/03/27 17:46:49 provos Exp $");
 
 #include "xmalloc.h"
 
@@ -69,6 +69,8 @@ parse_prime(int linenum, char *line, struct dhgroup *dhg)
         if (cp == NULL || *strsize == '\0' ||
             (dhg->size = atoi(strsize)) == 0)
                 goto fail;
+        /* The whole group is one bit larger */
+        dhg->size++;
         gen = strsep(&cp, " "); /* gen */
         if (cp == NULL || *gen == '\0')
                 goto fail;
@@ -95,7 +97,7 @@ parse_prime(int linenum, char *line, struct dhgroup *dhg)
 }
 
 DH *
-choose_dh(int minbits)
+choose_dh(int min, int wantbits, int max)
 {
         FILE *f;
         char line[1024];
@@ -118,8 +120,11 @@ choose_dh(int minbits)
                 BN_free(dhg.g);
                 BN_free(dhg.p);
 
-                if ((dhg.size > minbits && dhg.size < best) ||
-                    (dhg.size > best && best < minbits)) {
+                if (dhg.size > max || dhg.size < min)
+                        continue;
+
+                if ((dhg.size > wantbits && dhg.size < best) ||
+                    (dhg.size > best && best < wantbits)) {
                         best = dhg.size;
                         bestcount = 0;
                 }
@@ -129,8 +134,8 @@ choose_dh(int minbits)
         fclose (f);
 
         if (bestcount == 0) {
-                log("WARNING: no primes in %s, using old prime", _PATH_DH_PRIMES);
-                return (dh_new_group1());
+                log("WARNING: no suitable primes in %s", _PATH_DH_PRIMES);
+                return (NULL);
         }
 
         f = fopen(_PATH_DH_PRIMES, "r");
@@ -143,6 +148,8 @@ choose_dh(int minbits)
         while (fgets(line, sizeof(line), f)) {
                 if (!parse_prime(linenum, line, &dhg))
                         continue;
+                if (dhg.size > max || dhg.size < min)
+                        continue;
                 if (dhg.size != best)
                         continue;
                 if (linenum++ != which) {