]> git.ipfire.org Git - thirdparty/openvpn.git/commit
Fix OpenSSL 1.1.1 not using auto elliptic curve selection
authorArne Schwabe <arne@rfc2549.org>
Sat, 28 Mar 2020 04:08:58 +0000 (05:08 +0100)
committerGert Doering <gert@greenie.muc.de>
Wed, 15 Apr 2020 10:10:43 +0000 (12:10 +0200)
commit5ee76a8fab0411c7529c8da9f40ad386433d9a0c
tree8377ae5c848637101b3f04a4c4bee7d6c9bd9229
parented925c0a8d3e6aa8bc26de8c0e7ed79a47e5c7d6
Fix OpenSSL 1.1.1 not using auto elliptic curve selection

Commit 8a01147ff attempted to avoid calling the deprecated/noop
operation SSL_CTX_set_ecdh_auto by surrounding it with #ifdef.
Unfortunately, that change also made the return; that would exit
the function no longer being compiled when using OpenSSL 1.1.0+.
As consequence OpenVPN with OpenSSL 1.1.0+ would always set
secp384r1 as ecdh curve unless otherwise specified by ecdh

This patch restores the correct/previous behaviour.
Acked-by: Antonio Quartulli <antonio@openvpn.net>
Message-Id: <20200328040858.16505-1-arne@rfc2549.org>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg19630.html

Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit d8ac887c6b1b57a1953ab62058b4aed5d8c11f65)
src/openvpn/ssl_openssl.c