Overview
Comment: | Updated to auto set DH parameters. Updated to use well known Diffie-Hellman (DH) parameters that have built-in support in OpenSSL. This means the DH parameters will be selected to be consistent with the size of the key associated with the server's certificate. If there is no certificate (e.g. for PSK ciphersuites), then it it will be consistent with the size of the negotiated symmetric cipher key. |
---|---|
Downloads: | Tarball | ZIP archive | SQL archive |
Timelines: | family | ancestors | descendants | both | dh |
Files: | files | file ages | folders |
SHA3-256: |
d3d16ea77fa810d88369837ab3361f58 |
User & Date: | bohagan on 2023-12-29 03:09:08 |
Original User & Date: | bohagan on 2023-12-29 03:09:09 |
Other Links: | branch diff | manifest | tags |
Context
2023-12-29
| ||
03:09 | Merged in dh branch check-in: 594dfd3195 user: bohagan tags: trunk | |
03:09 | Updated to auto set DH parameters. Updated to use well known Diffie-Hellman (DH) parameters that have built-in support in OpenSSL. This means the DH parameters will be selected to be consistent with the size of the key associated with the server's certificate. If there is no certificate (e.g. for PSK ciphersuites), then it it will be consistent with the size of the negotiated symmetric cipher key. Leaf check-in: d3d16ea77f user: bohagan tags: dh | |
00:46 | Use env var for OpenSSL executable path. Source: https://core.tcl-lang.org/tcltls/tktview/034c8d2587 check-in: e63b467c48 user: bohagan tags: dh | |
Changes
Modified Makefile.in from [3d826d82ee] to [5c4bcb5d55].
︙ | |||
59 60 61 62 63 64 65 | 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 | - + | PKG_LIB_FILE = @PKG_LIB_FILE@ PKG_LIB_FILE8 = @PKG_LIB_FILE8@ PKG_LIB_FILE9 = @PKG_LIB_FILE9@ PKG_STUB_LIB_FILE = @PKG_STUB_LIB_FILE@ lib_BINARIES = $(PKG_LIB_FILE) |
︙ | |||
156 157 158 159 160 161 162 | 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 | - + | # that your library may use. TCL_DEFS can actually be a problem if # you do not compile with a similar machine setup as the Tcl core was # compiled with. #DEFS = $(TCL_DEFS) @DEFS@ $(PKG_CFLAGS) DEFS = @DEFS@ $(PKG_CFLAGS) # Move pkgIndex.tcl to 'BINARIES' var if it is generated in the Makefile |
︙ | |||
318 319 320 321 322 323 324 | 318 319 320 321 322 323 324 325 326 327 328 329 330 331 | - - - - - | # this extension tls.tcl.h: @srcdir@/library/tls.tcl Makefile od -A n -v -t xC < '@srcdir@/library/tls.tcl' > tls.tcl.h.new.1 sed 's@[^0-9A-Fa-f]@@g;s@..@0x&, @g' < tls.tcl.h.new.1 > tls.tcl.h.new.2 rm -f tls.tcl.h.new.1 mv tls.tcl.h.new.2 @srcdir@/generic/tls.tcl.h |
︙ |
Modified acinclude.m4 from [a920d53daa] to [7f4a09fb4a].
︙ | |||
43 44 45 46 47 48 49 | 43 44 45 46 47 48 49 50 51 52 53 54 55 56 | - - - - - - - - - - - - - - - - - - - - - - - | if test "${enableval}" = "no"; then AC_DEFINE([NO_TLS1_3], [1], [Disable TLS1.3 protocol]) AC_MSG_CHECKING([for disable TLS1.3 protocol]) AC_MSG_RESULT('yes') fi ]) |
︙ |
Modified configure from [4c56eae107] to [3a830b9e57].
︙ | |||
643 644 645 646 647 648 649 | 643 644 645 646 647 648 649 650 651 652 653 654 655 656 657 658 659 660 661 662 663 664 | - - - + + + - + | #ifdef HAVE_UNISTD_H # include <unistd.h> #endif" ac_header_c_list= ac_subst_vars='LTLIBOBJS TCLSH_PROG |
︙ | |||
716 717 718 719 720 721 722 | 716 717 718 719 720 721 722 723 724 725 726 727 728 729 | - | PKG_CFLAGS PKG_LIBS PKG_INCLUDES PKG_HEADERS PKG_TCL_SOURCES PKG_STUB_OBJECTS PKG_STUB_SOURCES |
︙ | |||
778 779 780 781 782 783 784 | 777 778 779 780 781 782 783 784 785 786 787 788 789 790 791 792 793 794 795 796 797 798 799 800 801 802 803 804 805 806 807 808 809 810 | - - - - - + + + | enable_64bit_vis enable_rpath enable_symbols enable_tls1 enable_tls1_1 enable_tls1_2 enable_tls1_3 |
︙ | |||
1430 1431 1432 1433 1434 1435 1436 | 1427 1428 1429 1430 1431 1432 1433 1434 1435 1436 1437 1438 1439 1440 1441 1442 1443 1444 1445 1446 1447 1448 1449 1450 1451 1452 | - - - - | --enable-64bit-vis enable 64bit Sparc VIS support (default: off) --disable-rpath disable rpath support (default: on) --enable-symbols build with debugging symbols (default: off) --disable-tls1 disable TLS1 protocol --disable-tls1_1 disable TLS1.1 protocol --disable-tls1_2 disable TLS1.2 protocol --disable-tls1_3 disable TLS1.3 protocol |
︙ | |||
1468 1469 1470 1471 1472 1473 1474 | 1461 1462 1463 1464 1465 1466 1467 1468 1469 1470 1471 1472 1473 1474 1475 1476 1477 1478 1479 1480 | - - + + | CFLAGS C compiler flags LDFLAGS linker flags, e.g. -L<lib dir> if you have libraries in a nonstandard directory <lib dir> LIBS libraries to pass to the linker, e.g. -l<library> CPPFLAGS (Objective) C/C++ preprocessor flags, e.g. -I<include dir> if you have headers in a nonstandard directory <include dir> CPP C preprocessor |
︙ | |||
2610 2611 2612 2613 2614 2615 2616 | 2603 2604 2605 2606 2607 2608 2609 2610 2611 2612 2613 2614 2615 2616 | - - | # This package name must be replaced statically for AC_SUBST to work |
︙ | |||
5506 5507 5508 5509 5510 5511 5512 | 5497 5498 5499 5500 5501 5502 5503 5504 5505 5506 5507 5508 5509 5510 5511 | - + | # Add pkgIndex.tcl if it is generated in the Makefile instead of ./configure # and change Makefile.in to move it from CONFIG_CLEAN_FILES to BINARIES var. # # A few miscellaneous platform-specific items: # TEA_ADD_* any platform specific compiler/build info here. #-------------------------------------------------------------------- |
︙ | |||
8869 8870 8871 8872 8873 8874 8875 | 8860 8861 8862 8863 8864 8865 8866 8867 8868 8869 8870 8871 8872 8873 8874 8875 8876 8877 8878 8879 8880 8881 8882 8883 8884 8885 8886 8887 8888 8889 8890 8891 8892 8893 8894 8895 8896 8897 8898 8899 8900 8901 8902 8903 8904 8905 8906 8907 8908 8909 8910 8911 8912 8913 8914 8915 8916 8917 8918 8919 8920 | + + + - + + - - + + + + + - + + + + | PACKAGE_LIB_PREFIX=lib${PACKAGE_LIB_PREFIX} fi eval eval "PKG_LIB_FILE8=${PACKAGE_LIB_PREFIX8}${PACKAGE_NAME}${UNSHARED_LIB_SUFFIX}" eval eval "PKG_LIB_FILE9=${PACKAGE_LIB_PREFIX9}${PACKAGE_NAME}${UNSHARED_LIB_SUFFIX}" eval eval "PKG_LIB_FILE=${PACKAGE_LIB_PREFIX}${PACKAGE_NAME}${UNSHARED_LIB_SUFFIX}" fi # Some packages build their own stubs libraries if test "${TCL_MAJOR_VERSION}" -gt 8 -a x"${with_tcl8}" == x; then eval eval "PKG_STUB_LIB_FILE=${PACKAGE_LIB_PREFIX8}${PACKAGE_NAME}stub.a" else |
︙ | |||
9006 9007 9008 9009 9010 9011 9012 | 9007 9008 9009 9010 9011 9012 9013 9014 9015 9016 9017 9018 9019 9020 9021 | - + | printf "%s\n" "$ac_ct_PKG_CONFIG" >&6; } else { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 printf "%s\n" "no" >&6; } fi if test "x$ac_ct_PKG_CONFIG" = x; then |
︙ | |||
9089 9090 9091 9092 9093 9094 9095 | 9090 9091 9092 9093 9094 9095 9096 9097 9098 9099 9100 9101 9102 9103 | - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - | { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: 'yes'" >&5 printf "%s\n" "'yes'" >&6; } fi fi |
︙ | |||
9203 9204 9205 9206 9207 9208 9209 | 9164 9165 9166 9167 9168 9169 9170 9171 9172 9173 9174 9175 9176 9177 | - - - - - - | fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for static linking of openSSL libraries" >&5 printf %s "checking for static linking of openSSL libraries... " >&6; } { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $TCLEXT_TLS_STATIC_SSL" >&5 printf "%s\n" "$TCLEXT_TLS_STATIC_SSL" >&6; } |
︙ | |||
9235 9236 9237 9238 9239 9240 9241 | 9190 9191 9192 9193 9194 9195 9196 9197 9198 9199 9200 9201 9202 9203 9204 9205 9206 9207 9208 9209 9210 9211 9212 9213 9214 9215 9216 9217 9218 9219 9220 9221 9222 9223 9224 9225 9226 9227 9228 9229 9230 9231 9232 9233 9234 9235 9236 9237 9238 9239 9240 9241 9242 9243 9244 9245 9246 9247 9248 9249 9250 9251 9252 9253 9254 9255 9256 9257 9258 9259 9260 9261 9262 9263 9264 9265 9266 9267 9268 9269 9270 9271 9272 9273 9274 9275 9276 | - + - + + + + - + - + - - + + + + + + + | then : withval=$with_openssl_includedir; opensslincludedir="$withval" else $as_nop if test -n "$openssldir"; then |
︙ | |||
9321 9322 9323 9324 9325 9326 9327 | 9284 9285 9286 9287 9288 9289 9290 9291 9292 9293 9294 9295 9296 9297 9298 9299 9300 9301 9302 9303 9304 9305 9306 9307 9308 9309 9310 9311 9312 9313 9314 9315 9316 9317 9318 9319 9320 9321 9322 9323 9324 9325 | + + + + + + + + - - - - - + + + + + - - - + + + - - - - - - - - - - - - - - + + + + + + + + + + + | fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for OpenSSL pkgconfig" >&5 printf %s "checking for OpenSSL pkgconfig... " >&6; } { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $opensslpkgconfigdir" >&5 printf "%s\n" "$opensslpkgconfigdir" >&6; } # Use Package Config tool to get config pkgConfigExtraArgs='' if test "${SHARED_BUILD}" == 0 -o "$TCLEXT_TLS_STATIC_SSL" = 'yes'; then pkgConfigExtraArgs='--static' fi if test -n "${PKG_CONFIG}"; then |
︙ |
Modified configure.ac from [ac9d3aa5eb] to [d5f3ebd9b3].
︙ | |||
86 87 88 89 90 91 92 | 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 | - + | # Add pkgIndex.tcl if it is generated in the Makefile instead of ./configure # and change Makefile.in to move it from CONFIG_CLEAN_FILES to BINARIES var. # # A few miscellaneous platform-specific items: # TEA_ADD_* any platform specific compiler/build info here. #-------------------------------------------------------------------- |
︙ |
Deleted generic/gen_dh_params version [6e6f58d906].
Modified generic/tls.c from [7c1b9c1884] to [54886bd843].
︙ | |||
60 61 62 63 64 65 66 | 60 61 62 63 64 65 66 67 68 69 70 71 72 73 | - - - - - - - - | #define TLS_PROTO_TLS1_1 0x08 #define TLS_PROTO_TLS1_2 0x10 #define TLS_PROTO_TLS1_3 0x20 #define ENABLED(flag, mask) (((flag) & (mask)) == (mask)) #define SSLKEYLOGFILE "SSLKEYLOGFILE" |
︙ | |||
1908 1909 1910 1911 1912 1913 1914 1915 | 1900 1901 1902 1903 1904 1905 1906 1907 1908 1909 1910 1911 1912 1913 1914 1915 1916 1917 1918 1919 1920 1921 1922 1923 1924 | + + + + - - + + + + + - - + | BIO_free(bio); Tcl_DStringFree(&ds); if (!dh) { Tcl_AppendResult(interp, "Could not read DH parameters from file", (char *) NULL); SSL_CTX_free(ctx); return NULL; } SSL_CTX_set_tmp_dh(ctx, dh); DH_free(dh); } else { /* Use well known DH parameters that have built-in support in OpenSSL */ |
︙ |
Modified win/README.txt from [5b3b0a3a95] to [9a1eb98644].
︙ | |||
56 57 58 59 60 61 62 | 56 57 58 59 60 61 62 63 64 65 66 67 68 69 | - - | set TCLINSTALL=\path\to\tcl\dir 2a) Unzip distribution to %BUILDDIR% 2b) Start BASH shell (MinGW62 Git shell) cd %BUILDDIR% |
︙ |