denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

openssl: Require min version 3.0.0 for HKDF to support larger MODP groups and nonces

Browse Source 
Also enables the `kdf` plugin automatically if building against an older
version of OpenSSL.

Closes strongswan/strongswan#2602

Co-authored-by: Tobias Brunner <[email protected]>
This commit is contained in:
Nathan Tran
2025-01-15 18:11:18 +01:00
committed by Tobias Brunner
co-authored by Tobias Brunner
parent d860c26e95
commit 1d5c5a1d72
3 changed files with 23 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
configure.ac
+15 -2
View File
@@ -525,15 +525,28 @@ if test x$cert_enroll = xtrue; then
fi
if test x$kdf = xfalse; then
openssl_hkdf=false
if test x$openssl = xtrue; then
AC_MSG_CHECKING(for OpenSSL >= 3.0 for HKDF)
AC_COMPILE_IFELSE(
[AC_LANG_PROGRAM(
[[#include <openssl/opensslv.h>]],
[[#if OPENSSL_VERSION_NUMBER < 0x30000000L && !defined(OPENSSL_IS_AWSLC)
#error OpenSSL version unusable
#endif]])],
[AC_MSG_RESULT([yes]); openssl_hkdf=true],
[AC_MSG_RESULT([no])]
)
fi
if test x$aesni = xtrue -o x$cmac = xtrue -o x$xcbc = xtrue; then
AC_MSG_WARN(m4_normalize([
kdf plugin is required for possible use of PRF_AES128_XCBC/CMAC
by one of these plugins: aesni, cmac, xcbc]))
kdf=true
elif test x$botan = xfalse -a x$openssl = xfalse -a x$wolfssl = xfalse; then
elif test x$botan = xfalse -a x$openssl_hkdf = xfalse -a x$wolfssl = xfalse; then
AC_MSG_WARN(m4_normalize([
kdf plugin is required because none of the following plugins is
enabled: botan, openssl, wolfssl]))
enabled or usable: botan, openssl, wolfssl]))
kdf=true
fi
fi