diff mbox series

[Openvpn-devel,v3,06/21,OSSL,3.0] Deprecate --ecdh-curve with OpenSSL 3.0 and adjust mbed TLS message

Message ID 20211019183127.614175-7-arne@rfc2549.org
State Accepted
Headers
Series OpenSSL 3.0 improvements for OpenVPN |

Commit Message

Arne Schwabe Oct. 19, 2021, 7:31 a.m. UTC 
  OpenSSL 3.0 deprecates SSL_CTX_set_tmp_ecdh() in favour of
SSL_CTX_set1_groups(3). We already support the SSL_CTX_set1_groups
using the --tls-groups. Adjust both mbed TLS and OpenSSL 3.0 to
say that --ecdh-curve is ingored and --tls-groups should be used.

Signed-off-by: Arne Schwabe <arne@rfc2549.org>
---
 src/openvpn/ssl_mbedtls.c |  5 +++--
 src/openvpn/ssl_openssl.c | 12 +++++++++---
 2 files changed, 12 insertions(+), 5 deletions(-)

Comments

Maximilian Fillinger Oct. 21, 2021, 1:37 a.m. UTC | #1 
On 19/10/2021 20:31, Arne Schwabe wrote:
> OpenSSL 3.0 deprecates SSL_CTX_set_tmp_ecdh() in favour of
> SSL_CTX_set1_groups(3). We already support the SSL_CTX_set1_groups
> using the --tls-groups. Adjust both mbed TLS and OpenSSL 3.0 to
> say that --ecdh-curve is ingored and --tls-groups should be used.
> 
> Signed-off-by: Arne Schwabe <arne@rfc2549.org>

Acked-by: Max Fillinger <maximilian.fillinger@foxcrypto.com>

Not much to say here. It compiles and I can see the warning when I use 
the option.
Gert Doering Oct. 21, 2021, 2:55 a.m. UTC | #2 
I have not tested this further, just done a cursory stare-at-code.

Your patch has been applied to the master branch.

commit 39eb3125e4f433fc61c92321175f663f13f163e7
Author: Arne Schwabe
Date:   Tue Oct 19 20:31:12 2021 +0200

     Deprecate --ecdh-curve with OpenSSL 3.0 and adjust mbed TLS message

     Signed-off-by: Arne Schwabe <arne@rfc2549.org>
     Acked-by: Max Fillinger <maximilian.fillinger@foxcrypto.com>
     Message-Id: <20211019183127.614175-7-arne@rfc2549.org>
     URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22999.html
     Signed-off-by: Gert Doering <gert@greenie.muc.de>


--
kind regards,

Gert Doering
diff mbox series

Patch

diff --git a/src/openvpn/ssl_mbedtls.c b/src/openvpn/ssl_mbedtls.c
index cea88f41e..e7c45c099 100644
--- a/src/openvpn/ssl_mbedtls.c
+++ b/src/openvpn/ssl_mbedtls.c
@@ -440,8 +440,9 @@  tls_ctx_load_ecdh_params(struct tls_root_ctx *ctx, const char *curve_name
 {
     if (NULL != curve_name)
     {
-        msg(M_WARN, "WARNING: mbed TLS builds do not support specifying an ECDH "
-            "curve, using default curves.");
+        msg(M_WARN, "WARNING: mbed TLS builds do not support specifying an "
+            "ECDH curve with --ecdh-curve, using default curves. Use "
+            "--tls-groups to specify curves.");
     }
 }
 
diff --git a/src/openvpn/ssl_openssl.c b/src/openvpn/ssl_openssl.c
index a44d4f85c..92d8d0eeb 100644
--- a/src/openvpn/ssl_openssl.c
+++ b/src/openvpn/ssl_openssl.c
@@ -709,10 +709,16 @@  tls_ctx_load_dh_params(struct tls_root_ctx *ctx, const char *dh_file,
 }
 
 void
-tls_ctx_load_ecdh_params(struct tls_root_ctx *ctx, const char *curve_name
-                         )
+tls_ctx_load_ecdh_params(struct tls_root_ctx *ctx, const char *curve_name)
 {
-#ifndef OPENSSL_NO_EC
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+    if (curve_name != NULL)
+    {
+        msg(M_WARN, "WARNING: OpenSSL 3.0+ builds do not support specifying an "
+                    "ECDH curve with --ecdh-curve, using default curves. Use "
+                    "--tls-groups to specify groups.");
+    }
+#elif !defined(OPENSSL_NO_EC)
     int nid = NID_undef;
     EC_KEY *ecdh = NULL;
     const char *sname = NULL;