Fix error compiling with openssl 1.1.0

[umurmur.git] / src / ssli_openssl.c

diff --git a/src/ssli_openssl.c b/src/ssli_openssl.c
index bcd4d9e7897ea24005d76c6034de801772b9bc38..8ff1bcf41400c02eaef71e85b0a7463e8aff27dd 100644 (file)
--- a/src/ssli_openssl.c
+++ b/src/ssli_openssl.c
@@ -49,6 +49,8 @@ static RSA *rsa;
 static SSL_CTX *context;
 static EVP_PKEY *pkey;
 
+static char const * ciphers = "EECDH+CHACHA20:EECDH+AESGCM:EECDH+AES+TLSv1.2:EECDH+AES:AESGCM:AES:!aNULL:!DHE:!kECDH";
+
 static int verify_callback(int preverify_ok, X509_STORE_CTX *ctx);
 
 static int SSL_add_ext(X509 * crt, int nid, char *value) {
@@ -221,12 +223,21 @@ void SSLi_init(void)
        ERR_load_crypto_strings();
 
        context = SSL_CTX_new(SSLv23_server_method());
+       SSL_CTX_set_options(context, SSL_OP_NO_SSLv2);
+       SSL_CTX_set_options(context, SSL_OP_NO_SSLv3);
+       SSL_CTX_set_options(context, SSL_OP_CIPHER_SERVER_PREFERENCE);
        if (context == NULL)
        {
                ERR_print_errors_fp(stderr);
                abort();
        }
 
+       SSL_CTX_set_cipher_list(context, ciphers);
+
+       EC_KEY *ecdhkey = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
+       SSL_CTX_set_tmp_ecdh(context, ecdhkey);
+       EC_KEY_free(ecdhkey);
+
        char const * sslCAPath = getStrConf(CAPATH);
        if(sslCAPath != NULL)
        {
@@ -400,7 +411,7 @@ static int verify_callback(int preverify_ok, X509_STORE_CTX *ctx)
      * it for something special
      */
     if (!preverify_ok && (err == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT)) {
-           X509_NAME_oneline(X509_get_issuer_name(ctx->current_cert), buf, 256);
+           X509_NAME_oneline(X509_get_issuer_name(err_cert), buf, 256);
            Log_warn("issuer= %s", buf);
     }
     return 1;