Skip to content

Commit baedba6

Browse files
Force client haveDH to true in wolfSSL_set_options. haveDH won't be set to true on the client as the server side is what calls DH param generation APIs which set this to true, but we still want the client to support DH cipher suites if enabled. This matches behavior from InitSSL_EitherSide.
1 parent 0f0163d commit baedba6

1 file changed

Lines changed: 9 additions & 1 deletion

File tree

src/ssl.c

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17128,7 +17128,15 @@ long wolfSSL_set_options(WOLFSSL* ssl, long op)
1712817128
if (AllocateSuites(ssl) != 0)
1712917129
return 0;
1713017130
if (!ssl->suites->setSuites) {
17131-
InitSuites(ssl->suites, ssl->version, keySz, haveRSA,
17131+
/* Client side won't set DH params, so it needs haveDH set to TRUE. */
17132+
if (ssl->options.side == WOLFSSL_CLIENT_END)
17133+
InitSuites(ssl->suites, ssl->version, keySz, haveRSA,
17134+
havePSK, TRUE, ssl->options.haveECDSAsig,
17135+
ssl->options.haveECC, TRUE, ssl->options.haveStaticECC,
17136+
ssl->options.useAnon,
17137+
TRUE, TRUE, TRUE, TRUE, ssl->options.side);
17138+
else
17139+
InitSuites(ssl->suites, ssl->version, keySz, haveRSA,
1713217140
havePSK, ssl->options.haveDH, ssl->options.haveECDSAsig,
1713317141
ssl->options.haveECC, TRUE, ssl->options.haveStaticECC,
1713417142
ssl->options.useAnon,

0 commit comments

Comments
 (0)