From 48e1d180a46b8caaf6b4619db07d078fb7cbcc60 Mon Sep 17 00:00:00 2001 From: David Benjamin Date: Mon, 13 Mar 2017 16:56:30 -0400 Subject: [PATCH] Restore SSL_CTX_set_ecdh_auto compatibility hook. This was inadvertently dropped in 59015c365b53a855513aaf5f9ff4597df9157ac0. Python otherwise configures P-256 if it assumes our OpenSSL predate's 1.0.2's multi-curve support. This disables X25519, our preferred curve. Change-Id: Ibf758583ea53e68c56667f16ee7096656bac719b Reviewed-on: https://boringssl-review.googlesource.com/14208 Commit-Queue: David Benjamin Commit-Queue: Steven Valdez Reviewed-by: Steven Valdez CQ-Verified: CQ bot account: commit-bot@chromium.org --- PORTING.md | 1 + include/openssl/ssl.h | 7 +++++++ 2 files changed, 8 insertions(+) diff --git a/PORTING.md b/PORTING.md index 30d774ca3..b9d675230 100644 --- a/PORTING.md +++ b/PORTING.md @@ -227,6 +227,7 @@ parameter. `SSL_CTRL_OPTIONS` | `SSL_CTX_get_options` or `SSL_CTX_set_options` `SSL_CTRL_SESS_NUMBER` | `SSL_CTX_sess_number` `SSL_CTRL_SET_CURVES` | `SSL_CTX_set1_curves` +`SSL_CTRL_SET_ECDH_AUTO` | `SSL_CTX_set_ecdh_auto` `SSL_CTRL_SET_MAX_CERT_LIST` | `SSL_CTX_set_max_cert_list` `SSL_CTRL_SET_MAX_SEND_FRAGMENT` | `SSL_CTX_set_max_send_fragment` `SSL_CTRL_SET_MSG_CALLBACK` | `SSL_set_msg_callback` diff --git a/include/openssl/ssl.h b/include/openssl/ssl.h index 611d3b244..6e737af6c 100644 --- a/include/openssl/ssl.h +++ b/include/openssl/ssl.h @@ -3800,6 +3800,12 @@ OPENSSL_EXPORT const BIO_METHOD *BIO_f_ssl(void); * other than one on error. */ OPENSSL_EXPORT long BIO_set_ssl(BIO *bio, SSL *ssl, int take_owership); +/* SSL_CTX_set_ecdh_auto returns one. */ +#define SSL_CTX_set_ecdh_auto(ctx, onoff) 1 + +/* SSL_set_ecdh_auto returns one. */ +#define SSL_set_ecdh_auto(ssl, onoff) 1 + /* Private structures. * @@ -4294,6 +4300,7 @@ struct ssl_ctx_st { #define SSL_CTRL_SESS_NUMBER doesnt_exist #define SSL_CTRL_SET_CURVES doesnt_exist #define SSL_CTRL_SET_CURVES_LIST doesnt_exist +#define SSL_CTRL_SET_ECDH_AUTO doesnt_exist #define SSL_CTRL_SET_MAX_CERT_LIST doesnt_exist #define SSL_CTRL_SET_MAX_SEND_FRAGMENT doesnt_exist #define SSL_CTRL_SET_MSG_CALLBACK doesnt_exist