]> git.kaiwu.me - nginx.git/commit
SSL: external groups support in $ssl_curve and $ssl_curves.
authorSergey Kandaurov <pluknet@nginx.com>
Thu, 3 Apr 2025 11:29:31 +0000 (15:29 +0400)
committerpluknet <pluknet@nginx.com>
Thu, 10 Apr 2025 14:51:10 +0000 (18:51 +0400)
commitb6e7eb0f5792d7a52d2675ee3906e502d63c48e3
tree145e5dd9adc9c5c6b9a4eced0cce88286a648f10
parent6c3a9d561271ec451f479a84fbe54c81a63dad2e
SSL: external groups support in $ssl_curve and $ssl_curves.

Starting with OpenSSL 3.0, groups may be added externally with pluggable
KEM providers.  Using SSL_get_negotiated_group(), which makes lookup in a
static table with known groups, doesn't allow to list such groups by names
leaving them in hex.  Adding X25519MLKEM768 to the default group list in
OpenSSL 3.5 made this problem more visible.  SSL_get0_group_name() and,
apparently, SSL_group_to_name() allow to resolve such provider-implemented
groups, which is also "generally preferred" over SSL_get_negotiated_group()
as documented in OpenSSL git commit 93d4f6133f.

This change makes external groups listing by name using SSL_group_to_name()
available since OpenSSL 3.0.  To preserve "prime256v1" naming for the group
0x0017, and to avoid breaking BoringSSL and older OpenSSL versions support,
it is used supplementary for a group that appears to be unknown.

See https://github.com/openssl/openssl/issues/27137 for related discussion.
src/event/ngx_event_openssl.c