OpenSSL: Fix server side openssl_ecdh_curves configuration with 1.0.2

It looks like SSL_CTX_set1_curves_list() command alone is not sufficient
to enable ECDH curve selection with older OpenSSL versions for TLS
server, so enable automatic selection first and specify the exact list
of curves after that.

This fixes failures in openssl_ecdh_curves test case when hostapd uses
OpenSSL 1.0.2.

Signed-off-by: Jouni Malinen <j@w1.fi>

diff --git a/src/crypto/tls_openssl.c b/src/crypto/tls_openssl.c
index 47e074634362c5eeb8d638a3c10224ca0a460048..b0c23ae6c9b1f51def69fe19104226cb732b42ca 100644 (file)
--- a/src/crypto/tls_openssl.c
+++ b/src/crypto/tls_openssl.c
@@ -5037,6 +5037,9 @@ int tls_global_set_params(void *tls_ctx,
                return -1;
 #else /* OPENSSL_IS_BORINGSSL || < 1.0.2 */
 #ifndef OPENSSL_NO_EC
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
+               SSL_CTX_set_ecdh_auto(ssl_ctx, 1);
+#endif
                if (SSL_CTX_set1_curves_list(ssl_ctx,
                                             params->openssl_ecdh_curves) !=
                    1) {