From 39eb3125e4f433fc61c92321175f663f13f163e7 Mon Sep 17 00:00:00 2001 From: Arne Schwabe Date: Tue, 19 Oct 2021 20:31:12 +0200 Subject: [PATCH] Deprecate --ecdh-curve with OpenSSL 3.0 and adjust mbed TLS message OpenSSL 3.0 deprecates SSL_CTX_set_tmp_ecdh() in favour of SSL_CTX_set1_groups(3). We already support the SSL_CTX_set1_groups using the --tls-groups. Adjust both mbed TLS and OpenSSL 3.0 to say that --ecdh-curve is ingored and --tls-groups should be used. Signed-off-by: Arne Schwabe Acked-by: Max Fillinger Message-Id: <20211019183127.614175-7-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22999.html Signed-off-by: Gert Doering --- src/openvpn/ssl_mbedtls.c | 5 +++-- src/openvpn/ssl_openssl.c | 12 +++++++++--- 2 files changed, 12 insertions(+), 5 deletions(-) diff --git a/src/openvpn/ssl_mbedtls.c b/src/openvpn/ssl_mbedtls.c index cea88f41e..e7c45c099 100644 --- a/src/openvpn/ssl_mbedtls.c +++ b/src/openvpn/ssl_mbedtls.c @@ -440,8 +440,9 @@ tls_ctx_load_ecdh_params(struct tls_root_ctx *ctx, const char *curve_name { if (NULL != curve_name) { - msg(M_WARN, "WARNING: mbed TLS builds do not support specifying an ECDH " - "curve, using default curves."); + msg(M_WARN, "WARNING: mbed TLS builds do not support specifying an " + "ECDH curve with --ecdh-curve, using default curves. Use " + "--tls-groups to specify curves."); } } diff --git a/src/openvpn/ssl_openssl.c b/src/openvpn/ssl_openssl.c index 30fc7aef1..f2f29607b 100644 --- a/src/openvpn/ssl_openssl.c +++ b/src/openvpn/ssl_openssl.c @@ -690,10 +690,16 @@ tls_ctx_load_dh_params(struct tls_root_ctx *ctx, const char *dh_file, } void -tls_ctx_load_ecdh_params(struct tls_root_ctx *ctx, const char *curve_name - ) +tls_ctx_load_ecdh_params(struct tls_root_ctx *ctx, const char *curve_name) { -#ifndef OPENSSL_NO_EC +#if OPENSSL_VERSION_NUMBER >= 0x30000000L + if (curve_name != NULL) + { + msg(M_WARN, "WARNING: OpenSSL 3.0+ builds do not support specifying an " + "ECDH curve with --ecdh-curve, using default curves. Use " + "--tls-groups to specify groups."); + } +#elif !defined(OPENSSL_NO_EC) int nid = NID_undef; EC_KEY *ecdh = NULL; const char *sname = NULL; -- 2.47.2