denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

openssl: Require min version 3.0.0 for HKDF to support larger MODP groups and nonces

Browse Source 
Also enables the `kdf` plugin automatically if building against an older
version of OpenSSL.

Closes strongswan/strongswan#2602

Co-authored-by: Tobias Brunner <[email protected]>
This commit is contained in:
Nathan Tran
2025-01-15 18:11:18 +01:00
committed by Tobias Brunner
co-authored by Tobias Brunner
parent d860c26e95
commit 1d5c5a1d72
3 changed files with 23 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/plugins/openssl/openssl_plugin.c
+5 -2
View File
@@ -496,8 +496,11 @@ METHOD(plugin_t, get_features, int,
PLUGIN_PROVIDE(SIGNER, AUTH_HMAC_SHA2_512_256),
PLUGIN_PROVIDE(SIGNER, AUTH_HMAC_SHA2_512_512),
#endif
#if OPENSSL_VERSION_NUMBER >= 0x10101000L
/* HKDF is available since 1.1.0, expand-only mode only since 1.1.1 */
#if OPENSSL_VERSION_NUMBER >= 0x30000000L || \
defined (OPENSSL_IS_AWSLC)
/* HKDF is available since 1.1.0, expand-only mode only since 1.1.1,
* but 3.0.0 is required to support larger MODP groups and nonces
* with its 2048 byte buffer size */
PLUGIN_REGISTER(KDF, openssl_kdf_create),
PLUGIN_PROVIDE(KDF, KDF_PRF),
PLUGIN_PROVIDE(KDF, KDF_PRF_PLUS),