tree 021d3dad464870c0e4f6b99e944fcfa612cdd59e
parent 2559bc831885b7a8462822eee5c2b78232a60ea0
author Remi Tricot-Le Breton <rlebreton@haproxy.com> 1644338754 +0100
committer William Lallemand <wlallemand@haproxy.org> 1644401744 +0100

MINOR: ssl: Remove EC_KEY related calls when preparing SSL context

The ecdhe option relies on the SSL_CTX_set_tmp_ecdh function which has
been marked as deprecated in OpenSSLv3. As advised in the
SSL_CTX_set_tmp_ecdh manpage, this function should be replaced by the
SSL_CTX_set1_groups one (or the SSL_CTX_set1_curves one in our case
which does the same but existed on older OpenSSL versions as well).

When using the "curves" option we have a different behaviour with
OpenSSL1.0.2 compared to later versions. On this early version an SSL
backend using a P-256 ECDSA certificate manages to connect to an SSL
frontend having a "curves P-384" option (when it fails with later
versions).
Even if the API used for later version than OpenSSL 1.0.2 already
existed then, for some reason the behaviour is not the same on the older
version which explains why the original code with the deprecated API is
kept for this version (otherwise we would risk breaking everything on a
version that might still be used by some people despite being pretty old).

This patch should be strictly isofunctional.