/* Check if this key request is for us */
if(to == myself) { /* Yes, send our own key back */
- send_ans_key(from);
+ if (!send_ans_key(from))
+ return false;
} else {
if(tunnelserver)
return true;
to->inkey = xrealloc(to->inkey, to->inkeylength);
// Create a new key
- RAND_pseudo_bytes((unsigned char *)to->inkey, to->inkeylength);
+ if (1 != RAND_bytes((unsigned char *)to->inkey, to->inkeylength)) {
+ int err = ERR_get_error();
+ logger(LOG_ERR, "Failed to generate random for key (%s)", ERR_error_string(err, NULL));
+ return false; // Do not send insecure keys, let connection attempt fail.
+ }
+
if(to->incipher)
EVP_DecryptInit_ex(&to->inctx, to->incipher, NULL, (unsigned char *)to->inkey, (unsigned char *)to->inkey + to->incipher->key_len);