From: Alan T. DeKok <aland@freeradius.org>
Date: Tue, 13 Apr 2021 14:44:42 +0000 (-0400)
Subject: use OpenSSL APIs from 1.0.2 or later
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d036e89bd2b12c08acd695efbc303d1e4505d0f3;p=thirdparty%2Ffreeradius-server.git

use OpenSSL APIs from 1.0.2 or later

which will automatically pick the correct curve.
---

diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap
index b1cd2d7b736..991040454ca 100644
--- a/raddb/mods-available/eap
+++ b/raddb/mods-available/eap
@@ -535,7 +535,11 @@ eap {
 		#
 		#  ecdh_curve:: Elliptical cryptography configuration.
 		#
-		#  Only for OpenSSL >= 0.9.8.f
+		#  Should be a colin-separated list of curve names.
+		#
+		#  For supported curve names, please run the command:a
+		#
+		#	openssl ecparam -list_curves
 		#
 		ecdh_curve = prime256v1
 
diff --git a/src/lib/tls/ctx.c b/src/lib/tls/ctx.c
index 1685dcece84..851cdf59443 100644
--- a/src/lib/tls/ctx.c
+++ b/src/lib/tls/ctx.c
@@ -44,31 +44,23 @@ USES_APPLE_DEPRECATED_API	/* OpenSSL API has been deprecated by Apple */
 #ifndef OPENSSL_NO_ECDH
 static int ctx_ecdh_curve_set(SSL_CTX *ctx, char const *ecdh_curve, bool disable_single_dh_use)
 {
-	int      nid;
-	EC_KEY  *ecdh;
+	char *list;
+
+	if (!disable_single_dh_use) {
+		SSL_CTX_set_options(ctx, SSL_OP_SINGLE_ECDH_USE);
+	}
 
 	if (!ecdh_curve || !*ecdh_curve) return 0;
 
-	nid = OBJ_sn2nid(ecdh_curve);
-	if (!nid) {
+	list = strdup(ecdh_curve);
+	if (SSL_CTX_set1_curves_list(ctx, list) == 0) {
+		free(list);
 		ERROR("Unknown ecdh_curve \"%s\"", ecdh_curve);
 		return -1;
 	}
+	free(list);
 
-	ecdh = EC_KEY_new_by_curve_name(nid);
-	if (!ecdh) {
-		ERROR("Unable to create new curve \"%s\"", ecdh_curve);
-		return -1;
-	}
-
-	SSL_CTX_set_tmp_ecdh(ctx, ecdh);
-
-	if (!disable_single_dh_use) {
-		SSL_CTX_set_options(ctx, SSL_OP_SINGLE_ECDH_USE);
-	}
-
-	EC_KEY_free(ecdh);
-
+	(void) SSL_CTX_set_ecdh_auto(ctx, 1);
 	return 0;
 }
 #endif