MINOR: ssl: Remove EC_KEY related calls when creating a certificate

In the context of the 'generate-certificates' bind line option, if an
'ecdhe' option is present on the bind line as well, we use the
SSL_CTX_set_tmp_ecdh function which was marked as deprecated in
OpenSSLv3. As advised in the SSL_CTX_set_tmp_ecdh manpage, this function
should be replaced by the SSL_CTX_set1_groups one (or the
SSL_CTX_set1_curves one in our case which does the same but existed on
older OpenSSL versions as well).

The ECDHE behaviour with OpenSSL 1.0.2 is not the same when using the
SSL_CTX_set1_curves function as the one we have on newer versions.
Instead of looking for a code that would work exactly the same
regardless of the OpenSSL version, we will keep the original code on
1.0.2 and use newer APIs for other versions.

This patch should be strictly isofunctional.

diff --git a/src/ssl_sock.c b/src/ssl_sock.c
index 7a9d94af33590b96db387d286caf08bf3298e88b..1bfb18689886bbc4fd90064c7ad08f877ae9e2b8 100644 (file)
--- a/src/ssl_sock.c
+++ b/src/ssl_sock.c
@@ -2209,6 +2209,16 @@ ssl_sock_do_create_cert(const char *servername, struct bind_conf *bind_conf, SSL
 #ifndef OPENSSL_NO_DH
        SSL_CTX_set_tmp_dh_callback(ssl_ctx, ssl_get_tmp_dh);
 #endif
+
+#if (HA_OPENSSL_VERSION_NUMBER >= 0x10101000L)
+#if defined(SSL_CTX_set1_curves_list)
+       {
+               const char *ecdhe = (bind_conf->ssl_conf.ecdhe ? bind_conf->ssl_conf.ecdhe : ECDHE_DEFAULT_CURVE);
+               if (!SSL_CTX_set1_curves_list(ssl_ctx, ecdhe))
+                       goto end;
+       }
+#endif
+#else
 #if defined(SSL_CTX_set_tmp_ecdh) && !defined(OPENSSL_NO_ECDH)
        {
                const char *ecdhe = (bind_conf->ssl_conf.ecdhe ? bind_conf->ssl_conf.ecdhe : ECDHE_DEFAULT_CURVE);
@@ -2222,7 +2232,8 @@ ssl_sock_do_create_cert(const char *servername, struct bind_conf *bind_conf, SSL
                SSL_CTX_set_tmp_ecdh(ssl_ctx, ecc);
                EC_KEY_free(ecc);
        }
-#endif
+#endif /* defined(SSL_CTX_set_tmp_ecdh) && !defined(OPENSSL_NO_ECDH) */
+#endif /* HA_OPENSSL_VERSION_NUMBER >= 0x10101000L */
  end:
        return ssl_ctx;