RepoMirrors/haproxy
1
0
Fork 0
mirror of http://git.haproxy.org/git/haproxy.git/ synced 2025-02-22 21:56:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

MINOR: ssl: Set default dh size to 2048

Browse Source 
Starting from OpenSSLv3, we won't rely on the
SSL_CTX_set_tmp_dh_callback mechanism so we will need to know the DH
size we want to use during init. In order for the default DH param size
to be used when no RSA or DSA private key can be found for a given bind
line, we will need to know the default size we want to use (which was
not possible the way the code was built, since the global default dh
size was set too late.
This commit is contained in:
Remi Tricot-Le Breton 2022-02-11 12:04:54 +01:00 committed by William Lallemand
parent bed72631f9
commit 55d7e782ee
2 changed files with 1 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
include/haproxy/defaults.h
View File

@ -354,7 +354,7 @@
/* ssl max dh param size */
#ifndef SSL_DEFAULT_DH_PARAM
#define SSL_DEFAULT_DH_PARAM 0
#define SSL_DEFAULT_DH_PARAM 2048
#endif
/* max memory cost per SSL session */

11
src/ssl_sock.c
View File

@ -4772,17 +4772,6 @@ static int ssl_sock_prepare_ctx(struct bind_conf *bind_conf, struct ssl_bind_con
#endif
#ifndef OPENSSL_NO_DH
/* If tune.ssl.default-dh-param has not been set,
neither has ssl-default-dh-file and no static DH
params were in the certificate file. */
if (global_ssl.default_dh_param == 0 &&
global_dh == NULL &&
(ssl_dh_ptr_index == -1 ||
SSL_CTX_get_ex_data(ctx, ssl_dh_ptr_index) == NULL)) {
/* default to dh-param 2048 */
global_ssl.default_dh_param = 2048;
}
if (global_ssl.default_dh_param >= 1024) {
if (local_dh_1024 == NULL) {
local_dh_1024 = ssl_get_dh_1024();