kenmirrors/asterisk
1
0
Fork 0
mirror of https://github.com/asterisk/asterisk.git synced 2025-09-02 19:16:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge "tcptls: Allow OpenSSL configured with no-dh."

Browse Source
This commit is contained in:
Joshua Colp
2018-06-06 04:36:06 -05:00
committed by Gerrit Code Review
parent 76339b1962 d36338ce2b
commit 2151903a16
1 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
main/tcptls.c
View File

@@ -471,8 +471,7 @@ static int __ssl_setup(struct ast_tls_config *cfg, int client)
}
}
#ifdef HAVE_OPENSSL_EC
#ifndef OPENSSL_NO_DH
if (!ast_strlen_zero(cfg->pvtfile)) {
BIO *bio = BIO_new_file(cfg->pvtfile, "r");
if (bio != NULL) {
@@ -488,12 +487,15 @@ static int __ssl_setup(struct ast_tls_config *cfg, int client)
BIO_free(bio);
}
}
#endif
#ifndef SSL_CTRL_SET_ECDH_AUTO
#define SSL_CTRL_SET_ECDH_AUTO 94
#endif
/* SSL_CTX_set_ecdh_auto(cfg->ssl_ctx, on); requires OpenSSL 1.0.2 which wraps: */
if (SSL_CTX_ctrl(cfg->ssl_ctx, SSL_CTRL_SET_ECDH_AUTO, 1, NULL)) {
ast_verb(2, "TLS/SSL ECDH initialized (automatic), faster PFS ciphers enabled\n");
#if !defined(OPENSSL_NO_ECDH) && (OPENSSL_VERSION_NUMBER >= 0x10000000L) && (OPENSSL_VERSION_NUMBER < 0x10100000L)
} else {
/* enables AES-128 ciphers, to get AES-256 use NID_secp384r1 */
EC_KEY *ecdh = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
@@ -503,10 +505,9 @@ static int __ssl_setup(struct ast_tls_config *cfg, int client)
}
EC_KEY_free(ecdh);
}
#endif
}
#endif /* #ifdef HAVE_OPENSSL_EC */
ast_verb(2, "TLS/SSL certificate ok\n"); /* We should log which one that is ok. This message doesn't really make sense in production use */
return 1;
#endif