| Message ID | 20211019183127.614175-7-arne@rfc2549.org |
|---|---|
| State | Accepted |
| Headers | show |
| Series | OpenSSL 3.0 improvements for OpenVPN | expand |
On 19/10/2021 20:31, Arne Schwabe wrote: > OpenSSL 3.0 deprecates SSL_CTX_set_tmp_ecdh() in favour of > SSL_CTX_set1_groups(3). We already support the SSL_CTX_set1_groups > using the --tls-groups. Adjust both mbed TLS and OpenSSL 3.0 to > say that --ecdh-curve is ingored and --tls-groups should be used. > > Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Max Fillinger <maximilian.fillinger@foxcrypto.com> Not much to say here. It compiles and I can see the warning when I use the option.
I have not tested this further, just done a cursory stare-at-code.
Your patch has been applied to the master branch.
commit 39eb3125e4f433fc61c92321175f663f13f163e7
Author: Arne Schwabe
Date: Tue Oct 19 20:31:12 2021 +0200
Deprecate --ecdh-curve with OpenSSL 3.0 and adjust mbed TLS message
Signed-off-by: Arne Schwabe <arne@rfc2549.org>
Acked-by: Max Fillinger <maximilian.fillinger@foxcrypto.com>
Message-Id: <20211019183127.614175-7-arne@rfc2549.org>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22999.html
Signed-off-by: Gert Doering <gert@greenie.muc.de>
--
kind regards,
Gert Doering
diff --git a/src/openvpn/ssl_mbedtls.c b/src/openvpn/ssl_mbedtls.c index cea88f41e..e7c45c099 100644 --- a/src/openvpn/ssl_mbedtls.c +++ b/src/openvpn/ssl_mbedtls.c @@ -440,8 +440,9 @@ tls_ctx_load_ecdh_params(struct tls_root_ctx *ctx, const char *curve_name { if (NULL != curve_name) { - msg(M_WARN, "WARNING: mbed TLS builds do not support specifying an ECDH " - "curve, using default curves."); + msg(M_WARN, "WARNING: mbed TLS builds do not support specifying an " + "ECDH curve with --ecdh-curve, using default curves. Use " + "--tls-groups to specify curves."); } } diff --git a/src/openvpn/ssl_openssl.c b/src/openvpn/ssl_openssl.c index a44d4f85c..92d8d0eeb 100644 --- a/src/openvpn/ssl_openssl.c +++ b/src/openvpn/ssl_openssl.c @@ -709,10 +709,16 @@ tls_ctx_load_dh_params(struct tls_root_ctx *ctx, const char *dh_file, } void -tls_ctx_load_ecdh_params(struct tls_root_ctx *ctx, const char *curve_name - ) +tls_ctx_load_ecdh_params(struct tls_root_ctx *ctx, const char *curve_name) { -#ifndef OPENSSL_NO_EC +#if OPENSSL_VERSION_NUMBER >= 0x30000000L + if (curve_name != NULL) + { + msg(M_WARN, "WARNING: OpenSSL 3.0+ builds do not support specifying an " + "ECDH curve with --ecdh-curve, using default curves. Use " + "--tls-groups to specify groups."); + } +#elif !defined(OPENSSL_NO_EC) int nid = NID_undef; EC_KEY *ecdh = NULL; const char *sname = NULL;
OpenSSL 3.0 deprecates SSL_CTX_set_tmp_ecdh() in favour of SSL_CTX_set1_groups(3). We already support the SSL_CTX_set1_groups using the --tls-groups. Adjust both mbed TLS and OpenSSL 3.0 to say that --ecdh-curve is ingored and --tls-groups should be used. Signed-off-by: Arne Schwabe <arne@rfc2549.org> --- src/openvpn/ssl_mbedtls.c | 5 +++-- src/openvpn/ssl_openssl.c | 12 +++++++++--- 2 files changed, 12 insertions(+), 5 deletions(-)