diff --git a/config.h.in b/config.h.in index 8e2312964..7576e1509 100644 --- a/config.h.in +++ b/config.h.in @@ -82,6 +82,10 @@ `SSL_COMP_get_compression_methods', and to 0 if you don't. */ #undef HAVE_DECL_SSL_COMP_GET_COMPRESSION_METHODS +/* Define to 1 if you have the declaration of `SSL_CTX_set_ecdh_auto', and to + 0 if you don't. */ +#undef HAVE_DECL_SSL_CTX_SET_ECDH_AUTO + /* Define to 1 if you have the declaration of `strlcat', and to 0 if you don't. */ #undef HAVE_DECL_STRLCAT @@ -327,9 +331,6 @@ /* Define if you have the SSL libraries installed. */ #undef HAVE_SSL -/* Define to 1 if you have the `SSL_CTX_set_ecdh_auto' function. */ -#undef HAVE_SSL_CTX_SET_ECDH_AUTO - /* Define to 1 if you have the header file. */ #undef HAVE_STDARG_H diff --git a/configure b/configure index 398fa1068..03c142257 100755 --- a/configure +++ b/configure @@ -16773,7 +16773,7 @@ fi done -for ac_func in OPENSSL_config EVP_sha1 EVP_sha256 EVP_sha512 FIPS_mode SSL_CTX_set_ecdh_auto +for ac_func in OPENSSL_config EVP_sha1 EVP_sha256 EVP_sha512 FIPS_mode do : as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh` ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var" @@ -16845,6 +16845,36 @@ fi cat >>confdefs.h <<_ACEOF #define HAVE_DECL_SK_SSL_COMP_POP_FREE $ac_have_decl _ACEOF +ac_fn_c_check_decl "$LINENO" "SSL_CTX_set_ecdh_auto" "ac_cv_have_decl_SSL_CTX_set_ecdh_auto" " +$ac_includes_default +#ifdef HAVE_OPENSSL_ERR_H +#include +#endif + +#ifdef HAVE_OPENSSL_RAND_H +#include +#endif + +#ifdef HAVE_OPENSSL_CONF_H +#include +#endif + +#ifdef HAVE_OPENSSL_ENGINE_H +#include +#endif +#include +#include + +" +if test "x$ac_cv_have_decl_SSL_CTX_set_ecdh_auto" = xyes; then : + ac_have_decl=1 +else + ac_have_decl=0 +fi + +cat >>confdefs.h <<_ACEOF +#define HAVE_DECL_SSL_CTX_SET_ECDH_AUTO $ac_have_decl +_ACEOF fi diff --git a/configure.ac b/configure.ac index 9c71ac4ea..1b27692f6 100644 --- a/configure.ac +++ b/configure.ac @@ -577,8 +577,8 @@ else fi AC_CHECK_HEADERS([openssl/conf.h],,, [AC_INCLUDES_DEFAULT]) AC_CHECK_HEADERS([openssl/engine.h],,, [AC_INCLUDES_DEFAULT]) -AC_CHECK_FUNCS([OPENSSL_config EVP_sha1 EVP_sha256 EVP_sha512 FIPS_mode SSL_CTX_set_ecdh_auto]) -AC_CHECK_DECLS([SSL_COMP_get_compression_methods,sk_SSL_COMP_pop_free], [], [], [ +AC_CHECK_FUNCS([OPENSSL_config EVP_sha1 EVP_sha256 EVP_sha512 FIPS_mode]) +AC_CHECK_DECLS([SSL_COMP_get_compression_methods,sk_SSL_COMP_pop_free,SSL_CTX_set_ecdh_auto], [], [], [ AC_INCLUDES_DEFAULT #ifdef HAVE_OPENSSL_ERR_H #include diff --git a/daemon/remote.c b/daemon/remote.c index 6f7888803..fec046f9a 100644 --- a/daemon/remote.c +++ b/daemon/remote.c @@ -258,7 +258,7 @@ daemon_remote_create(struct config_file* cfg) log_crypto_err("Error in SSL_CTX check_private_key"); goto setup_error; } -#ifdef SSL_CTX_SET_ECDH_AUTO +#ifdef HAVE_DECL_SSL_CTX_SET_ECDH_AUTO if(!SSL_CTX_set_ecdh_auto(rc->ctx,1)) { log_crypto_err("Error in SSL_CTX_ecdh_auto, not enabling ECDHE"); } diff --git a/doc/Changelog b/doc/Changelog index 651d73644..6c37f0d95 100644 --- a/doc/Changelog +++ b/doc/Changelog @@ -1,3 +1,6 @@ +21 July 2015: Wouter + - Fix configure to detect SSL_CTX_set_ecdh_auto. + 20 July 2015: Wouter - Enable ECDHE for servers. Where available, use SSL_CTX_set_ecdh_auto() for TLS-wrapped server configurations to diff --git a/testcode/petal.c b/testcode/petal.c index 2661c3e4d..3996cde8a 100644 --- a/testcode/petal.c +++ b/testcode/petal.c @@ -242,7 +242,7 @@ setup_ctx(char* key, char* cert) print_exit("cannot read key"); if(!SSL_CTX_check_private_key(ctx)) print_exit("private key is not correct"); -#ifdef SSL_CTX_SET_ECDH_AUTO +#ifdef HAVE_DECL_SSL_CTX_SET_ECDH_AUTO if (!SSL_CTX_set_ecdh_auto(ctx,1)) if(verb>=1) printf("failed to set_ecdh_auto, not enabling ECDHE\n"); #elif defined(USE_ECDSA) diff --git a/util/net_help.c b/util/net_help.c index 59b3f91d5..b4703366c 100644 --- a/util/net_help.c +++ b/util/net_help.c @@ -647,7 +647,7 @@ void* listen_sslctx_create(char* key, char* pem, char* verifypem) SSL_CTX_free(ctx); return NULL; } -#ifdef SSL_CTX_SET_ECDH_AUTO +#ifdef HAVE_DECL_SSL_CTX_SET_ECDH_AUTO if(!SSL_CTX_set_ecdh_auto(ctx,1)) { log_crypto_err("Error in SSL_CTX_ecdh_auto, not enabling ECDHE"); }