From 5ee76a8fab0411c7529c8da9f40ad386433d9a0c Mon Sep 17 00:00:00 2001 From: Arne Schwabe Date: Sat, 28 Mar 2020 05:08:58 +0100 Subject: [PATCH] Fix OpenSSL 1.1.1 not using auto elliptic curve selection Commit 8a01147ff attempted to avoid calling the deprecated/noop operation SSL_CTX_set_ecdh_auto by surrounding it with #ifdef. Unfortunately, that change also made the return; that would exit the function no longer being compiled when using OpenSSL 1.1.0+. As consequence OpenVPN with OpenSSL 1.1.0+ would always set secp384r1 as ecdh curve unless otherwise specified by ecdh This patch restores the correct/previous behaviour. Acked-by: Antonio Quartulli Message-Id: <20200328040858.16505-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg19630.html Signed-off-by: Gert Doering (cherry picked from commit d8ac887c6b1b57a1953ab62058b4aed5d8c11f65) --- src/openvpn/ssl_openssl.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/openvpn/ssl_openssl.c b/src/openvpn/ssl_openssl.c index b3e247c2d..19509b7a6 100644 --- a/src/openvpn/ssl_openssl.c +++ b/src/openvpn/ssl_openssl.c @@ -634,8 +634,11 @@ tls_ctx_load_ecdh_params(struct tls_root_ctx *ctx, const char *curve_name /* OpenSSL 1.0.2 and newer can automatically handle ECDH parameter * loading */ SSL_CTX_set_ecdh_auto(ctx->ctx, 1); - return; + + /* OpenSSL 1.1.0 and newer have always ecdh auto loading enabled, + * so do nothing */ #endif + return; #else /* For older OpenSSL we have to extract the curve from key on our own */ EC_KEY *eckey = NULL; -- 2.47.2