Restore SSL_CTX_set_ecdh_auto compatibility hook. This was inadvertently dropped in 59015c365b53a855513aaf5f9ff4597df9157ac0. Python otherwise configures P-256 if it assumes our OpenSSL predate's 1.0.2's multi-curve support. This disables X25519, our preferred curve. Change-Id: Ibf758583ea53e68c56667f16ee7096656bac719b Reviewed-on: https://boringssl-review.googlesource.com/14208 Commit-Queue: David Benjamin <davidben@google.com> Commit-Queue: Steven Valdez <svaldez@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
diff --git a/PORTING.md b/PORTING.md index 30d774c..b9d6752 100644 --- a/PORTING.md +++ b/PORTING.md
@@ -227,6 +227,7 @@ `SSL_CTRL_OPTIONS` | `SSL_CTX_get_options` or `SSL_CTX_set_options` `SSL_CTRL_SESS_NUMBER` | `SSL_CTX_sess_number` `SSL_CTRL_SET_CURVES` | `SSL_CTX_set1_curves` +`SSL_CTRL_SET_ECDH_AUTO` | `SSL_CTX_set_ecdh_auto` `SSL_CTRL_SET_MAX_CERT_LIST` | `SSL_CTX_set_max_cert_list` `SSL_CTRL_SET_MAX_SEND_FRAGMENT` | `SSL_CTX_set_max_send_fragment` `SSL_CTRL_SET_MSG_CALLBACK` | `SSL_set_msg_callback`
diff --git a/include/openssl/ssl.h b/include/openssl/ssl.h index 611d3b2..6e737af 100644 --- a/include/openssl/ssl.h +++ b/include/openssl/ssl.h
@@ -3800,6 +3800,12 @@ * other than one on error. */ OPENSSL_EXPORT long BIO_set_ssl(BIO *bio, SSL *ssl, int take_owership); +/* SSL_CTX_set_ecdh_auto returns one. */ +#define SSL_CTX_set_ecdh_auto(ctx, onoff) 1 + +/* SSL_set_ecdh_auto returns one. */ +#define SSL_set_ecdh_auto(ssl, onoff) 1 + /* Private structures. * @@ -4294,6 +4300,7 @@ #define SSL_CTRL_SESS_NUMBER doesnt_exist #define SSL_CTRL_SET_CURVES doesnt_exist #define SSL_CTRL_SET_CURVES_LIST doesnt_exist +#define SSL_CTRL_SET_ECDH_AUTO doesnt_exist #define SSL_CTRL_SET_MAX_CERT_LIST doesnt_exist #define SSL_CTRL_SET_MAX_SEND_FRAGMENT doesnt_exist #define SSL_CTRL_SET_MSG_CALLBACK doesnt_exist