search

processone / fast_tls

TLS / SSL OpenSSL-based native driver for Erlang / Elixir
https://www.ejabberd.im
Other
83 stars 37 forks source link

ECDH curve auto-selection. #21

Closed pitchum closed 7 years ago

pitchum commented 7 years ago

Should fix #20

Since openssl 1.0.2 there is no need to hard-code the curves.

Cf. https://www.openssl.org/docs/man1.0.2/ssl/SSL_CTX_set_ecdh_auto.html#NOTES:

The functions SSL_CTX_set_ecdh_auto() and SSL_set_ecdh_auto() can be used to make a server always choose the most appropriate curve for a client.

zinid commented 7 years ago

Travis is complaining:

{load_failed,"Failed to load NIF library: '/home/travis/build/processone/fast_tls/priv/lib/fast_tls.so: undefined symbol: SSL_CTX_set_ecdh_auto'"}

Looks like the patch is not compatible with older openssl versions.

pitchum commented 7 years ago

openssl versions before 1.0.2 are not supported anymore. Cf. https://www.openssl.org/source/:

The latest stable version is the 1.1.0 series of releases. Also available is the 1.0.2 series. This is also our Long Term Support (LTS) version (support will be provided until 31st December 2019). The 0.9.8, 1.0.0 and 1.0.1 versions are now out of support and should not be used.

Can you please enforce travis to use openssl >= 1.0.2? I've no idea how to to this.

zinid commented 7 years ago

I don't think we can just drop supporting old openssl versions, especially having that 1.0.2 is only 3 years old. That's not how we do things. So #ifdef/#ifndef probably is required to be added to the code.

zinid commented 7 years ago

Every versions starting from 1.0.0 should be supported.

prefiks commented 7 years ago

I commited a version of this commit with added compatibility code for newer openssl version as b9c17209cc4a9cf149f8a64903b4c2b46c125dac