Index: gen_dh_params ================================================================== --- gen_dh_params +++ gen_dh_params @@ -3,10 +3,11 @@ bits='2048' openssl_dhparam() { if [ -x "`which openssl 2>/dev/null`" ]; then o_output="`openssl dhparam -C "$@" 2>/dev/null`" || return 1 + o_output="`echo "${o_output}" | sed 's/get_dh[0-9]\+/get_dhParams/'`" || return 1 o_output="`echo "${o_output}" | sed '/^-----BEGIN DH PARAMETERS-----$/,/^-----END DH PARAMETERS-----$/ d;/^#/ d'`" || return 1 echo "${o_output}" return 0 @@ -34,12 +35,13 @@ return 1 } gen_dh_params_fallback() { - cat << \_EOF_ -DH *get_dh2048(void) { + if [ "${bits}" = '2048' ]; then + cat << \_EOF_ +DH *get_dhParams(void) { static unsigned char dhp_2048[] = { 0xC1,0x51,0x58,0x69,0xFB,0xE8,0x6C,0x47,0x2B,0x86,0x61,0x4F, 0x20,0x2E,0xD3,0xFC,0x19,0xEE,0xB8,0xF3,0x35,0x7D,0xBA,0x86, 0x2A,0xC3,0xC8,0x6E,0xF4,0x99,0x75,0x65,0xD3,0x7A,0x9E,0xDF, 0xD4,0x1F,0x88,0xE3,0x17,0xFC,0xA1,0xED,0xA2,0xB6,0x77,0x84, @@ -91,15 +93,22 @@ } return(dh); } _EOF_ + + return 0 + fi + + return 1 } # Enable support for giving the same DH params each time if [ "$1" = 'fallback' ]; then gen_dh_params_fallback && exit 0 + + echo "Unable to generate fallback parameters for DH of ${bits} bits" >&2 exit 1 fi echo "*****************************" >&2 @@ -107,7 +116,9 @@ echo "** This will take a while. **" >&2 echo "*****************************" >&2 gen_dh_params_openssl && exit 0 gen_dh_params_remote && exit 0 gen_dh_params_fallback && exit 0 + +echo "Unable to generate parameters for DH of ${bits} bits" >&2 exit 1 Index: tls.c ================================================================== --- tls.c +++ tls.c @@ -1179,11 +1179,11 @@ "Could not read DH parameters from file", (char *) NULL); SSL_CTX_free(ctx); return (SSL_CTX *)0; } } else { - dh = get_dh2048(); + dh = get_dhParams(); } SSL_CTX_set_tmp_dh(ctx, dh); DH_free(dh); } #endif