upstream/openvpn
1
0
Fork 0
mirror of https://github.com/OpenVPN/openvpn.git synced 2026-05-28 04:03:29 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Do not support tls_ctx_set_cert_profile on AWS-LC

Browse source 
SSL_CTX_set_security_level does nothing on AWS-LC and gives a deprecated
warning on compile. It is better to give the user a warning than to
effectively silently ignore it as well.

Change-Id: I74841d3611c62d3c59fc839bc73a0c83ce025262
Signed-off-by: Arne Schwabe <arne@rfc2549.org>
Acked-by: Frank Lichtenheld <frank@lichtenheld.com>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1579
Message-Id: <20260322111207.8346-1-gert@greenie.muc.de>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg36243.html
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 07954eea05)
This commit is contained in:
Arne Schwabe 2026-03-22 12:12:01 +01:00 committed by Gert Doering
parent 3888007826
commit 4577a0dc21
1 changed files with 5 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
src/openvpn/ssl_openssl.c
View file

@ -518,8 +518,9 @@ tls_ctx_restrict_ciphers_tls13(struct tls_root_ctx *ctx, const char *ciphers)
void
tls_ctx_set_cert_profile(struct tls_root_ctx *ctx, const char *profile)
{
#if OPENSSL_VERSION_NUMBER > 0x10100000L \
&& (!defined(LIBRESSL_VERSION_NUMBER) || LIBRESSL_VERSION_NUMBER > 0x3060000fL)
#if OPENSSL_VERSION_NUMBER > 0x10100000L \
&& (!defined(LIBRESSL_VERSION_NUMBER) || LIBRESSL_VERSION_NUMBER > 0x3060000fL) \
&& !defined(OPENSSL_IS_AWSLC)
/* OpenSSL does not have certificate profiles, but a complex set of
* callbacks that we could try to implement to achieve something similar.
* For now, use OpenSSL's security levels to achieve similar (but not equal)
@ -549,8 +550,8 @@ tls_ctx_set_cert_profile(struct tls_root_ctx *ctx, const char *profile)
if (profile)
{
msg(M_WARN,
"WARNING: OpenSSL 1.1.0 and LibreSSL do not support "
"--tls-cert-profile, ignoring user-set profile: '%s'",
"WARNING: OpenSSL 1.1.0, AWS-LC and LibreSSL < 3.6.0 do not "
"support --tls-cert-profile, ignoring user-set profile: '%s'",
profile);
}
#endif /* if OPENSSL_VERSION_NUMBER > 0x10100000L */