mirror of
https://github.com/haproxy/haproxy.git
synced 2026-07-11 02:02:18 -04:00
Add ssl_fips_check_curves() which validates the configured curve list against the FIPS-approved NIST P-curves (P-256, P-384, P-521). Each colon-separated name is resolved to a NID via OBJ_txt2nid() so all standard aliases (P-256, prime256v1, secp256r1) are handled uniformly. A NULL list is silently accepted since the global defaults were already overwritten with FIPS values at init time. The check is called right after SSL_CTX_set1_curves_list() in both the bind (ssl_sock_prepare_ctx) and server (ssl_sock_prepare_srv_ssl_ctx) configuration paths. |
||
|---|---|---|
| .. | ||
| haproxy | ||
| import | ||
| make | ||