Module: kamailio Branch: 5.4 Commit: 1142d5470d40801743af2fd9e27213bae6c394f4 URL: https://github.com/kamailio/kamailio/commit/1142d5470d40801743af2fd9e27213b… Author: SPChan &lt;shihping.chan(a)gmail.com&gt; Committer: Daniel-Constantin Mierla &lt;miconda(a)gmail.com&gt; Date: 2021-05-26T08:25:25+02:00 [tls] Don't use OpenSSL<1.0.2 fallback on 1.1+ Address GH #2716. Also see https://bugs.python.org/issue29697. (cherry picked from commit 27904530d1f8efd26e2b96fa5f18a3aad887919b) (cherry picked from commit 1c7a8459f1a5b0f4d96f3908a301b599d5e24dc3) --- Modified: src/modules/tls/tls_domain.c --- Diff: https://github.com/kamailio/kamailio/commit/1142d5470d40801743af2fd9e27213b… Patch: https://github.com/kamailio/kamailio/commit/1142d5470d40801743af2fd9e27213b… --- diff --git a/src/modules/tls/tls_domain.c b/src/modules/tls/tls_domain.c index a8859c4a31..22897075c7 100644 --- a/src/modules/tls/tls_domain.c +++ b/src/modules/tls/tls_domain.c @@ -55,8 +55,12 @@ extern EVP_PKEY * tls_engine_private_key(const char* key_id); * ECDHE is enabled only on OpenSSL 1.0.0e and later. * See http://www.openssl.org/news/secadv_20110906.txt * for details. + * Also, copied from _ssl.c of Python for correct initialization. + * Allow automatic ECDH curve selection (on OpenSSL 1.0.2+), or use + * prime256v1 by default. This is Apache mod_ssl's initialization + * policy, so we should be safe. OpenSSL 1.1 has it enabled by default. */ -#ifndef OPENSSL_NO_ECDH +#if !defined(OPENSSL_NO_ECDH) && !defined(OPENSSL_VERSION_1_1) static void setup_ecdh(SSL_CTX *ctx) { EC_KEY *ecdh; @@ -65,11 +69,15 @@ static void setup_ecdh(SSL_CTX *ctx) return; } +#if defined(SSL_CTX_set_ecdh_auto) + SSL_CTX_set_ecdh_auto(ctx, 1); +#else ecdh = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1); SSL_CTX_set_options(ctx, SSL_OP_SINGLE_ECDH_USE); SSL_CTX_set_tmp_ecdh(ctx, ecdh); EC_KEY_free(ecdh); +#endif } #endif @@ -670,7 +678,7 @@ static int set_cipher_list(tls_domain_t* d) tls_domain_str(d), cipher_list); return -1; } -#ifndef OPENSSL_NO_ECDH +#if !defined(OPENSSL_NO_ECDH) && !defined(OPENSSL_VERSION_1_1) setup_ecdh(d->ctx[i]); #endif #ifndef OPENSSL_NO_DH