Sets the elliptic curve parameters for the given context in order to enable ECDH ciphers. Adapted from NGINX SSL initialization code: https://github.com/nginx/nginx/blob/bfe36ba3185a477d2f8ce120577308646173b736/ src/event/ngx_event_openssl.c#L1080-L1161
| 344 | // https://github.com/nginx/nginx/blob/bfe36ba3185a477d2f8ce120577308646173b736/ |
| 345 | // src/event/ngx_event_openssl.c#L1080-L1161 |
| 346 | static Try<Nothing> initialize_ecdh_curve(SSL_CTX* ctx, const Flags& ssl_flags) |
| 347 | { |
| 348 | #if defined(SSL_OP_SINGLE_ECDH_USE) |
| 349 | // Let OpenSSL compute new ECDH parameters for each new handshake. |
| 350 | // In newer versions (1.0.2+) of OpenSSL this is the default, and |
| 351 | // this call has no effect. |
| 352 | SSL_CTX_set_options(ctx, SSL_OP_SINGLE_ECDH_USE); |
| 353 | #endif // SSL_OP_SINGLE_ECDH_USE |
| 354 | |
| 355 | #if (defined SSL_CTX_set1_curves_list || defined SSL_CTRL_SET_CURVES_LIST) |
| 356 | // If `SSL_CTX_set_ecdh_auto` is not defined, OpenSSL will ignore the |
| 357 | // preference order of the curve list and use its own algorithm to chose |
| 358 | // the right curve for a connection. |
| 359 | #if defined(SSL_CTX_set_ecdh_auto) |
| 360 | SSL_CTX_set_ecdh_auto(ctx, 1); |
| 361 | #endif // SSL_CTX_set_ecdh_auto |
| 362 | |
| 363 | if (ssl_flags.ecdh_curves == "auto") { |
| 364 | return Nothing(); |
| 365 | } |
| 366 | |
| 367 | if (SSL_CTX_set1_curves_list(ctx, ssl_flags.ecdh_curves.c_str()) != 1) { |
| 368 | unsigned long error = ERR_get_error(); |
| 369 | return Error( |
| 370 | "Could not load ECDH curves '" + ssl_flags.ecdh_curves + "' " + |
| 371 | "(OpenSSL error #" + stringify(error) + "): " + error_string(error)); |
| 372 | } |
| 373 | |
| 374 | VLOG(2) << "Using ecdh curves: " << ssl_flags.ecdh_curves; |
| 375 | #else // SSL_CTX_set1_curves_list || SSL_CTRL_SET_CURVES_LIST |
| 376 | string curve = |
| 377 | ssl_flags.ecdh_curves == "auto" ? "prime256v1" : ssl_flags.ecdh_curves; |
| 378 | |
| 379 | int nid = OBJ_sn2nid(curve.c_str()); |
| 380 | if (nid == 0) { |
| 381 | unsigned long error = ERR_get_error(); |
| 382 | return Error( |
| 383 | "Unknown curve '" + curve + "' (OpenSSL error #" + stringify(error) + |
| 384 | "): " + error_string(error)); |
| 385 | } |
| 386 | |
| 387 | EC_KEY* ecdh = EC_KEY_new_by_curve_name(nid); |
| 388 | if (ecdh == nullptr) { |
| 389 | unsigned long error = ERR_get_error(); |
| 390 | return Error( |
| 391 | "Error generating key from curve " + curve + "' (OpenSSL error #" + |
| 392 | stringify(error) + "): " + error_string(error)); |
| 393 | } |
| 394 | |
| 395 | SSL_CTX_set_tmp_ecdh(ctx, ecdh); |
| 396 | EC_KEY_free(ecdh); |
| 397 | |
| 398 | VLOG(2) << "Using ecdh curve: " << ssl_flags.ecdh_curves; |
| 399 | #endif // SSL_CTX_set1_curves_list || SSL_CTRL_SET_CURVES_LIST |
| 400 | return Nothing(); |
| 401 | } |
| 402 | #endif // OPENSSL_VERSION_NUMBER >= 0x0090800fL && !OPENSSL_NO_ECDH |
| 403 |
no test coverage detected