Browse code

[tls] Don't use OpenSSL<1.0.2 fallback on 1.1+

Address GH #2716. Also see https://bugs.python.org/issue29697.

(cherry picked from commit 27904530d1f8efd26e2b96fa5f18a3aad887919b)
(cherry picked from commit 1c7a8459f1a5b0f4d96f3908a301b599d5e24dc3)

SPChan authored on 27/04/2021 16:51:22 • Daniel-Constantin Mierla committed on 26/05/2021 06:25:25
Showing 1 changed files
... ...
@@ -55,8 +55,12 @@ extern EVP_PKEY * tls_engine_private_key(const char* key_id);
55 55
  * ECDHE is enabled only on OpenSSL 1.0.0e and later.
56 56
  * See http://www.openssl.org/news/secadv_20110906.txt
57 57
  * for details.
58
+ * Also, copied from _ssl.c of Python for correct initialization.
59
+ * Allow automatic ECDH curve selection (on OpenSSL 1.0.2+), or use
60
+ * prime256v1 by default.  This is Apache mod_ssl's initialization
61
+ * policy, so we should be safe. OpenSSL 1.1 has it enabled by default.
58 62
  */
59
-#ifndef OPENSSL_NO_ECDH
63
+#if !defined(OPENSSL_NO_ECDH) && !defined(OPENSSL_VERSION_1_1)
60 64
 static void setup_ecdh(SSL_CTX *ctx)
61 65
 {
62 66
    EC_KEY *ecdh;
... ...
@@ -65,11 +69,15 @@ static void setup_ecdh(SSL_CTX *ctx)
65 69
       return;
66 70
    }
67 71
 
72
+#if defined(SSL_CTX_set_ecdh_auto)
73
+   SSL_CTX_set_ecdh_auto(ctx, 1);
74
+#else
68 75
    ecdh = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
69 76
    SSL_CTX_set_options(ctx, SSL_OP_SINGLE_ECDH_USE);
70 77
    SSL_CTX_set_tmp_ecdh(ctx, ecdh);
71 78
 
72 79
    EC_KEY_free(ecdh);
80
+#endif
73 81
 }
74 82
 #endif
75 83
 
... ...
@@ -670,7 +678,7 @@ static int set_cipher_list(tls_domain_t* d)
670 678
 					tls_domain_str(d), cipher_list);
671 679
 			return -1;
672 680
 		}
673
-#ifndef OPENSSL_NO_ECDH
681
+#if !defined(OPENSSL_NO_ECDH) && !defined(OPENSSL_VERSION_1_1)
674 682
                 setup_ecdh(d->ctx[i]);
675 683
 #endif
676 684
 #ifndef OPENSSL_NO_DH