[Pound Mailing List] ECDHE patch
David Rufino <[email protected]>
| Newsgroups | gmane.comp.web.pound.general |
|---|---|
| Message-ID | <[email protected]> |
Hello, I've been trying to get Pound to support elliptic curve diffie hellman so that it supports robust forward secrecy (as IE apparently does not support regular DH). It looks like it requires a code change, so I've attached a patch which others may find useful. It initializes the ecdh group to P-256, and seems to allow negotiation of ecdhe ciphers. I don't really know what I'm doing here, so comments appreciated! Thanks, David
ecdh.patch
(application/octet-stream, 1.3 KB)
--- Pound-2.7b/config.c 2013-09-26 13:33:22.000000000 +0100
+++ Pound-2.7b-new/config.c 2013-12-26 23:41:00.000000000 +0000
@@ -216,6 +216,15 @@
return result;
}
+void
+set_ecdh(SSL_CTX *ctx)
+{
+ EC_KEY *ecdh = NULL;
+ ecdh = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
+ SSL_CTX_set_tmp_ecdh(ctx, ecdh);
+ EC_KEY_free(ecdh);
+ logmsg(LOG_INFO,"Initialized ECDH");
+}
/*
* parse a back-end
*/
@@ -351,6 +360,7 @@
SSL_CTX_set_session_id_context(res->ctx, (unsigned char *)lin, strlen(lin));
SSL_CTX_set_tmp_rsa_callback(res->ctx, RSA_tmp_callback);
SSL_CTX_set_tmp_dh_callback(res->ctx, DH_tmp_callback);
+ set_ecdh(res->ctx);
} else if(!regexec(&HTTPSCert, lin, 4, matches, 0)) {
if((res->ctx = SSL_CTX_new(SSLv23_client_method())) == NULL)
conf_err("SSL_CTX_new failed - aborted");
@@ -374,6 +384,7 @@
SSL_CTX_set_session_id_context(res->ctx, (unsigned char *)lin, strlen(lin));
SSL_CTX_set_tmp_rsa_callback(res->ctx, RSA_tmp_callback);
SSL_CTX_set_tmp_dh_callback(res->ctx, DH_tmp_callback);
+ set_ecdh(res->ctx);
} else if(!regexec(&Disabled, lin, 4, matches, 0)) {
res->disabled = atoi(lin + matches[1].rm_so);
} else if(!regexec(&End, lin, 4, matches, 0)) {