DH *dh;
if (s->cert->dh_tmp_auto) {
- DH *dhp = ssl_get_auto_dh(s);
- pkdh = EVP_PKEY_new();
- if (pkdh == NULL || dhp == NULL) {
- DH_free(dhp);
+ pkdh = ssl_get_auto_dh(s);
+ if (pkdh == NULL) {
SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
goto err;
}
- EVP_PKEY_assign_DH(pkdh, dhp);
pkdhp = pkdh;
} else {
pkdhp = cert->dh_tmp;
#include <openssl/dh.h>
#include <openssl/bn.h>
#include <openssl/provider.h>
+#include <openssl/param_build.h>
#include "internal/nelem.h"
#include "internal/evp.h"
#include "internal/tlsgroups.h"
return tls1_check_chain(s, x, pk, chain, -1);
}
-#ifndef OPENSSL_NO_DH
-DH *ssl_get_auto_dh(SSL *s)
+EVP_PKEY *ssl_get_auto_dh(SSL *s)
{
- DH *dhp;
- BIGNUM *p, *g;
+ EVP_PKEY *dhp = NULL;
+ BIGNUM *p;
int dh_secbits = 80;
+ EVP_PKEY_CTX *pctx = NULL;
+ OSSL_PARAM_BLD *tmpl = NULL;
+ OSSL_PARAM *params = NULL;
+
if (s->cert->dh_tmp_auto != 2) {
if (s->s3.tmp.new_cipher->algorithm_auth & (SSL_aNULL | SSL_aPSK)) {
if (s->s3.tmp.new_cipher->strength_bits == 256)
}
}
- dhp = DH_new();
- if (dhp == NULL)
- return NULL;
- g = BN_new();
- if (g == NULL || !BN_set_word(g, 2)) {
- DH_free(dhp);
- BN_free(g);
- return NULL;
- }
if (dh_secbits >= 192)
p = BN_get_rfc3526_prime_8192(NULL);
else if (dh_secbits >= 152)
p = BN_get_rfc3526_prime_2048(NULL);
else
p = BN_get_rfc2409_prime_1024(NULL);
- if (p == NULL || !DH_set0_pqg(dhp, p, NULL, g)) {
- DH_free(dhp);
- BN_free(p);
- BN_free(g);
- return NULL;
- }
+ if (p == NULL)
+ goto err;
+
+ pctx = EVP_PKEY_CTX_new_from_name(s->ctx->libctx, "DH", s->ctx->propq);
+ if (pctx == NULL
+ || EVP_PKEY_key_fromdata_init(pctx) != 1)
+ goto err;
+
+ tmpl = OSSL_PARAM_BLD_new();
+ if (tmpl == NULL
+ || !OSSL_PARAM_BLD_push_BN(tmpl, OSSL_PKEY_PARAM_FFC_P, p)
+ || !OSSL_PARAM_BLD_push_uint(tmpl, OSSL_PKEY_PARAM_FFC_G, 2))
+ goto err;
+
+ params = OSSL_PARAM_BLD_to_param(tmpl);
+ if (params == NULL || EVP_PKEY_fromdata(pctx, &dhp, params) != 1)
+ goto err;
+
+err:
+ OSSL_PARAM_BLD_free_params(params);
+ OSSL_PARAM_BLD_free(tmpl);
+ EVP_PKEY_CTX_free(pctx);
+ BN_free(p);
return dhp;
}
-#endif
static int ssl_security_cert_key(SSL *s, SSL_CTX *ctx, X509 *x, int op)
{