use OpenSSL APIs from 1.0.2 or later

which will automatically pick the correct curve.

diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap
index b1cd2d7b736cabb2d25fde3c8d4e14af68fffcae..991040454cab5e3a653a0060ec8dae9ca2904746 100644 (file)
--- a/raddb/mods-available/eap
+++ b/raddb/mods-available/eap
@@ -535,7 +535,11 @@ eap {
                #
                #  ecdh_curve:: Elliptical cryptography configuration.
                #
-               #  Only for OpenSSL >= 0.9.8.f
+               #  Should be a colin-separated list of curve names.
+               #
+               #  For supported curve names, please run the command:a
+               #
+               #       openssl ecparam -list_curves
                #
                ecdh_curve = prime256v1
 

diff --git a/src/lib/tls/ctx.c b/src/lib/tls/ctx.c
index 1685dcece84c323e57084dbe397eeb68fa460591..851cdf59443fbb518da512c0e7f09a7263057293 100644 (file)
--- a/src/lib/tls/ctx.c
+++ b/src/lib/tls/ctx.c
@@ -44,31 +44,23 @@ USES_APPLE_DEPRECATED_API   /* OpenSSL API has been deprecated by Apple */
 #ifndef OPENSSL_NO_ECDH
 static int ctx_ecdh_curve_set(SSL_CTX *ctx, char const *ecdh_curve, bool disable_single_dh_use)
 {
-       int      nid;
-       EC_KEY  *ecdh;
+       char *list;
+
+       if (!disable_single_dh_use) {
+               SSL_CTX_set_options(ctx, SSL_OP_SINGLE_ECDH_USE);
+       }
 
        if (!ecdh_curve || !*ecdh_curve) return 0;
 
-       nid = OBJ_sn2nid(ecdh_curve);
-       if (!nid) {
+       list = strdup(ecdh_curve);
+       if (SSL_CTX_set1_curves_list(ctx, list) == 0) {
+               free(list);
                ERROR("Unknown ecdh_curve \"%s\"", ecdh_curve);
                return -1;
        }
+       free(list);
 
-       ecdh = EC_KEY_new_by_curve_name(nid);
-       if (!ecdh) {
-               ERROR("Unable to create new curve \"%s\"", ecdh_curve);
-               return -1;
-       }
-
-       SSL_CTX_set_tmp_ecdh(ctx, ecdh);
-
-       if (!disable_single_dh_use) {
-               SSL_CTX_set_options(ctx, SSL_OP_SINGLE_ECDH_USE);
-       }
-
-       EC_KEY_free(ecdh);
-
+       (void) SSL_CTX_set_ecdh_auto(ctx, 1);
        return 0;
 }
 #endif