kenmirrors/freeswitch
1
0
Fork 0
mirror of https://github.com/signalwire/freeswitch.git synced 2025-04-14 16:15:04 +00:00
Code Issues Projects Releases Wiki Activity

Add support for EECDH to Sofia-SIP

Browse Source 
This adds support for the ephemeral elliptic curve Diffie-Hellman key
exchange, which provides for forward secrecy in the event that
long-term keys are compromised.

For the moment, we've hard-coded the curve as prime256v1.
This commit is contained in:
Travis Cross 2014-02-06 15:27:06 +00:00
parent 3fae719589
commit a96eefe8ee
1 changed files with 27 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
libs/sofia-sip/libsofia-sip-ua/tport/tport_tls.c
View File

@ -267,6 +267,27 @@ void tls_init(void) {
ONCE_INIT(tls_init_once); ONCE_INIT(tls_init_once);
} }
static
int tls_init_ecdh_curve(tls_t *tls)
{
int nid;
EC_KEY *ecdh;
if (!(nid = OBJ_sn2nid("prime256v1"))) {
tls_log_errors(1, "Couldn't find specified curve", 0);
errno = EIO;
return -1;
}
if (!(ecdh = EC_KEY_new_by_curve_name(nid))) {
tls_log_errors(1, "Couldn't create specified curve", 0);
errno = EIO;
return -1;
}
SSL_CTX_set_options(tls->ctx, SSL_OP_SINGLE_ECDH_USE);
SSL_CTX_set_tmp_ecdh(tls->ctx, ecdh);
EC_KEY_free(ecdh);
return 0;
}
static static
int tls_init_context(tls_t *tls, tls_issues_t const *ti) int tls_init_context(tls_t *tls, tls_issues_t const *ti)
{ {
@ -385,6 +406,12 @@ int tls_init_context(tls_t *tls, tls_issues_t const *ti)
SSL_CTX_set_verify_depth(tls->ctx, ti->verify_depth); SSL_CTX_set_verify_depth(tls->ctx, ti->verify_depth);
SSL_CTX_set_verify(tls->ctx, verify, tls_verify_cb); SSL_CTX_set_verify(tls->ctx, verify, tls_verify_cb);
if (tls_init_ecdh_curve(tls) == 0) {
SU_DEBUG_3(("%s\n", "tls: initialized ECDH"));
} else {
SU_DEBUG_3(("%s\n", "tls: failed to initialize ECDH"));
}
if (!SSL_CTX_set_cipher_list(tls->ctx, ti->ciphers)) { if (!SSL_CTX_set_cipher_list(tls->ctx, ti->ciphers)) {
SU_DEBUG_1(("%s: error setting cipher list\n", "tls_init_context")); SU_DEBUG_1(("%s: error setting cipher list\n", "tls_init_context"));
tls_log_errors(3, "tls_init_context", 0); tls_log_errors(3, "tls_init_context", 0);