pegasus/unrealircd
1
0
Fork 0
mirror of https://github.com/unrealircd/unrealircd.git synced 2026-06-30 09:46:37 +02:00
Code Activity

Fix ecdh-curve X25519 missing when using the defaults.

Browse Source 
In config.h we had a:
 #if OPENSSL_VERSION_NUMBER >= 0x10100000L
 #define UNREALIRCD_DEFAULT_ECDH_CURVES "X25519:secp521r1:secp384r1:prime256v1"
 #else
 #define UNREALIRCD_DEFAULT_ECDH_CURVES "secp521r1:secp384r1:prime256v1"
 #endif
...which is fine in theory, but openssl headers are not included at that point,
so OPENSSL_VERSION_NUMBER was not defined.

From now on, we have:
 #define UNREALIRCD_DEFAULT_ECDH_CURVES_PRIMARY "X25519:secp521r1:secp384r1:prime256v1"
 #define UNREALIRCD_DEFAULT_ECDH_CURVES_SECONDARY "secp521r1:secp384r1:prime256v1"
...and we try them in that order. If both fail, we exit with an error (like before).
This because X25519 is not available in OpenSSL before 1.1.0 (so really old)
and may also not be available when running in FIPS mode.
This commit is contained in:
Bram Matthys
2024-11-17 11:53:49 +01:00
parent 116e076f0d
commit cda2bcd930
4 changed files with 39 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
include/config.h
+5 -7
View File
@@ -267,14 +267,12 @@
/* Default TLS curves for ECDH(E)
* This can be changed via set::ssl::options::ecdh-curve in the config file.
* NOTE: This requires openssl 1.0.2 or newer, otherwise these defaults
* are not applied, due to the missing openssl API call.
* The UNREALIRCD_DEFAULT_ECDH_CURVES_PRIMARY is tried first, and then the
* UNREALIRCD_DEFAULT_ECDH_CURVES_SECONDARY, since tha latter requires
* openssl 1.1.0 or newer.
*/
#if OPENSSL_VERSION_NUMBER >= 0x10100000L
#define UNREALIRCD_DEFAULT_ECDH_CURVES "X25519:secp521r1:secp384r1:prime256v1"
#else
#define UNREALIRCD_DEFAULT_ECDH_CURVES "secp521r1:secp384r1:prime256v1"
#endif
#define UNREALIRCD_DEFAULT_ECDH_CURVES_PRIMARY "X25519:secp521r1:secp384r1:prime256v1"
#define UNREALIRCD_DEFAULT_ECDH_CURVES_SECONDARY "secp521r1:secp384r1:prime256v1"
/* These can be changed via set::central-spamfilter::url and ::feed */
#define DEFAULT_CENTRAL_SPAMFILTER_URL_OPEN_ACCESS "https://spamfilter.unrealircd.org/spamfilter/v6/$feed/central_spamfilter.conf"