BUILD: ssl: improve SSL_CTX_set_ecdh_auto compatibility
SSL_CTX_set_ecdh_auto() is not defined when OpenSSL 1.1.1 is compiled
with the no-deprecated option. Remove existing, incomplete guards and
add a compatibility macro in openssl-compat.h, just as OpenSSL does:
https://github.com/openssl/openssl/blob/bf4006a6f9be691ba6eef0e8629e63369a033ccf/include/openssl/ssl.h#L1486
This should be backported as far as 2.0 and probably even 1.9.
(cherry picked from commit a26d1e13245a760bd422e4e4b6a85cc17f9f0a60)
Signed-off-by: Willy Tarreau <w@1wt.eu>
(cherry picked from commit adb6019d31a0632a4d322ac652a53deddc90a420)
Signed-off-by: Willy Tarreau <w@1wt.eu>
diff --git a/include/common/openssl-compat.h b/include/common/openssl-compat.h
index bf6a97e..aeb8389 100644
--- a/include/common/openssl-compat.h
+++ b/include/common/openssl-compat.h
@@ -313,5 +313,9 @@
#define BIO_meth_set_destroy(m, f) do { (m)->destroy = (f); } while (0)
#endif
+#ifndef SSL_CTX_set_ecdh_auto
+#define SSL_CTX_set_ecdh_auto(dummy, onoff) ((onoff) != 0)
+#endif
+
#endif /* USE_OPENSSL */
#endif /* _COMMON_OPENSSL_COMPAT_H */
diff --git a/src/ssl_sock.c b/src/ssl_sock.c
index 1376c2a..b62ac44 100644
--- a/src/ssl_sock.c
+++ b/src/ssl_sock.c
@@ -4515,9 +4515,7 @@
curproxy->id, conf_curves, bind_conf->arg, bind_conf->file, bind_conf->line);
cfgerr++;
}
-#if defined(SSL_CTX_set_ecdh_auto)
(void)SSL_CTX_set_ecdh_auto(ctx, 1);
-#endif
}
#endif
#if defined(SSL_CTX_set_tmp_ecdh) && !defined(OPENSSL_NO_ECDH)