RE: RFC: Statically enable SSL_OP_SINGLE_DH_USE
>> I don't see it. Can you please elaborate what exact commit ID your are >> refering to? > > You are probably refering to the github fork, which is as always outdated, > and where line 2539 points to the local definition of SSL_OP_SINGLE_DH_USE: > #ifndef SSL_OP_SINGLE_ECDH_USE > #define SSL_OP_SINGLE_ECDH_USE 0 > #endif Actually I mixed up SSL_OP_SINGLE_DH_USE with SSL_OP_SINGLE_ECDH_USE, but the point is still the same. Lukas
Re: RFC: Statically enable SSL_OP_SINGLE_DH_USE
Hi Lukas, Lukas Tribus wrote: >>> I don't see it. Can you please elaborate what exact commit ID your are >>> refering to? >> You are probably refering to the github fork, which is as always outdated, >> and where line 2539 points to the local definition of SSL_OP_SINGLE_DH_USE: >> #ifndef SSL_OP_SINGLE_ECDH_USE >> #define SSL_OP_SINGLE_ECDH_USE 0 >> #endif > > Actually I mixed up SSL_OP_SINGLE_DH_USE with SSL_OP_SINGLE_ECDH_USE, but > the point is still the same. Ah, now it becomes clear. The #defines are just to set defaults if the constant isn't defined at all. Normally, the constant is defined by OpenSSL itself. As HAProxy sets it in [1], everything should be fine. Sorry for the noise from someone who reads way too little C code... Regards, Holger [1] http://git.haproxy.org/?p=haproxy.git;a=blob;f=src/src/ssl_sock.c;h=5cec6a4cd6ce5d16f9564e60fa57b24c46112bac;hb=HEAD#l2560
Re: RFC: Statically enable SSL_OP_SINGLE_DH_USE
Hi Lukas, Lukas Tribus wrote: > I don't see it. Can you please elaborate what exact commit ID your are > refering to? I was looking at http://git.haproxy.org/?p=haproxy.git;a=blob;f=src/src/ssl_sock.c;h=5cec6a4cd6ce5d16f9564e60fa57b24c46112bac;hb=HEAD#l2539 > As far as I an see we do the exact opossite of what you are saying > (enabling SSL_OP_SINGLE_DH_USE unconditionally). Sorry, it might well be that I'm too unfamiliar with the way these flags work. I assumed that setting it to 0 disabled the flag. If this is actually not the case, that I hereby retract by request and resolve to read more about how this is intended to work... Regards, Holger
RE: RFC: Statically enable SSL_OP_SINGLE_DH_USE
>> In HAProxy, this flag is currently statically disabled by default in >> src/ssl_sock.c line 2539. Thus, when used with older OpenSSL versions >> than 1.0.1r or 1.0.2f, users could be vulnerable. > > I don't see it. Can you please elaborate what exact commit ID your are > refering to? You are probably refering to the github fork, which is as always outdated, and where line 2539 points to the local definition of SSL_OP_SINGLE_DH_USE: #ifndef SSL_OP_SINGLE_ECDH_USE #define SSL_OP_SINGLE_ECDH_USE 0 #endif You are misunderstanding this code. We define SSL_OP_SINGLE_ECDH_USE when the openssl headers don't define it (which is when the openssl release doesn't support SSL_OP_SINGLE_ECDH_USE - older than 1.0.0), to avoid #ifdef hell in the ssl_sock_prepare_ctx function. So when OpenSSL supports SSL_OP_SINGLE_ECDH_USE, we *do* set it. Lukas
RE: RFC: Statically enable SSL_OP_SINGLE_DH_USE
> In HAProxy, this flag is currently statically disabled by default in > src/ssl_sock.c line 2539. Thus, when used with older OpenSSL versions > than 1.0.1r or 1.0.2f, users could be vulnerable. I don't see it. Can you please elaborate what exact commit ID your are refering to? As far as I an see we do the exact opossite of what you are saying (enabling SSL_OP_SINGLE_DH_USE unconditionally). Lukas
