Skip to content

Commit

Permalink
Make get_dh1024 compatible with OpenSSL v1.1.0
Browse files Browse the repository at this point in the history
Fixes the following error:

```
../../../../ext/puma_http11/mini_ssl.c: In function ‘get_dh1024’:
../../../../ext/puma_http11/mini_ssl.c:90:5: error: dereferencing pointer to incomplete type ‘DH {aka struct dh_st}’
   dh->p = BN_bin2bn(dh1024_p, sizeof(dh1024_p), NULL);
     ^~
```

These changes are based on the following patch to nginx:
<nginx/nginx@789abf2>
("SSL: default DH parameters compatible with OpenSSL 1.1.0").

Relevant parts of the nginx source code in their full context can be
found here:
<https://github.com/nginx/nginx/blob/release-1.10.2/src/event/ngx_event_openssl.c#L954-L980>.

For reference:

> *) Made DH and DH_METHOD opaque. The structures for managing DH objects
>    have been moved out of the public header files. New functions for managing
>    these have been added.
>    [Matt Caswell]

<https://www.openssl.org/news/cl110.txt>

Fixes #1136.
  • Loading branch information
Koronen committed Dec 16, 2016
1 parent 017348f commit 12a856e
Showing 1 changed file with 14 additions and 0 deletions.
14 changes: 14 additions & 0 deletions ext/puma_http11/mini_ssl.c
Original file line number Diff line number Diff line change
Expand Up @@ -87,13 +87,27 @@ DH *get_dh1024() {

DH *dh;
dh = DH_new();

#if OPENSSL_VERSION_NUMBER < 0x10100005L
dh->p = BN_bin2bn(dh1024_p, sizeof(dh1024_p), NULL);
dh->g = BN_bin2bn(dh1024_g, sizeof(dh1024_g), NULL);

if ((dh->p == NULL) || (dh->g == NULL)) {
DH_free(dh);
return NULL;
}
#else
BIGNUM *p, *g;
p = BN_bin2bn(dh1024_p, sizeof(dh1024_p), NULL);
g = BN_bin2bn(dh1024_g, sizeof(dh1024_g), NULL);

if (p == NULL || g == NULL || !DH_set0_pqg(dh, p, NULL, g)) {
DH_free(dh);
BN_free(p);
BN_free(g);
return NULL;
}
#endif

return dh;
}
Expand Down

0 comments on commit 12a856e

Please sign in to comment.