From a958e37e2034150998dad153fec3930788709b4b Mon Sep 17 00:00:00 2001 From: matt335672 <30179339+matt335672@users.noreply.github.com> Date: Mon, 28 Oct 2024 11:21:27 +0000 Subject: [PATCH 1/2] Remove calls to SSL_CTX_set_ecdh_auto() SSL_CTX_set_ecdh_auto() was introduced for OpenSSL 1.0.2. It has no effect for OpenSSL 1.1.0 and later. For versions before 1.0.2 and after (and including 1.1.0) it should not be called. The macro was erroneously being called twice for OpenSSL 3.0.0 and later - this has also been remedied --- common/ssl_calls.c | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/common/ssl_calls.c b/common/ssl_calls.c index 70d2d7c8f1..d44f878b46 100644 --- a/common/ssl_calls.c +++ b/common/ssl_calls.c @@ -1104,15 +1104,12 @@ ssl_tls_accept(struct ssl_tls *self, long ssl_protocols, return 1; } DH_free(dh); // ok to free, copied into ctx by SSL_CTX_set_tmp_dh() -#else - if (!SSL_CTX_set_dh_auto(self->ctx, 1)) - { - LOG(LOG_LEVEL_ERROR, "TLS DHE auto failed to be enabled"); - dump_ssl_error_stack(self); - return 1; - } #endif -#if defined(SSL_CTX_set_ecdh_auto) + +#if (OPENSSL_VERSION_NUMBER >= 0x10000020L) && \ + OPENSSL_VERSION_NUMBER < (0x10100000L) + // SSL_CTX_set_ecdh_auto() added in OpenSSL 1.0.2 and + // removed for OpenSSL 1.1.0 if (!SSL_CTX_set_ecdh_auto(self->ctx, 1)) { LOG(LOG_LEVEL_WARNING, "TLS ecdh auto failed to be enabled"); From 1e3acce73e328e12d0b8770fd35091e4ccf08c91 Mon Sep 17 00:00:00 2001 From: matt335672 <30179339+matt335672@users.noreply.github.com> Date: Mon, 28 Oct 2024 10:39:20 +0000 Subject: [PATCH 2/2] cppcheck 2.15.0 -> 2.16.0 --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 60959ad5ac..dafd25511b 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -180,7 +180,7 @@ jobs: CC: gcc # This is required to use a version of cppcheck other than that # supplied with the operating system - CPPCHECK_VER: "2.15.0" + CPPCHECK_VER: "2.16.0" CPPCHECK_REPO: https://github.com/danmar/cppcheck.git steps: # Set steps.os.outputs.image to the specific OS (e.g. 'ubuntu20')