tree 92adea6647a8b7814c35d219e60bc9438d8fcd4b
parent 12f93f4fc25055163b42cd91c215ff2c594f036c
author Gilles Peskine <Gilles.Peskine@arm.com> 1617278411 +0200
committer Gilles Peskine <Gilles.Peskine@arm.com> 1619517293 +0200

Fix SSL tests scripts with recent OpenSSL server with Diffie-Hellman

Our interoperability tests fail with a recent OpenSSL server. The
reason is that they force 1024-bit Diffie-Hellman parameters, which
recent OpenSSL (e.g. 1.1.1f on Ubuntu 20.04) reject:
```
140072814650688:error:1408518A:SSL routines:ssl3_ctx_ctrl:dh key too small:../ssl/s3_lib.c:3782:
```

We've been passing custom DH parameters since
6195767554da332e9f81e6510b07f7565ff8a538 because OpenSSL <=1.0.2a
requires it. This is only concerns the version we use as
OPENSSL_LEGACY. So only use custom DH parameters for that version. In
compat.sh, use it based on the observed version of $OPENSSL_CMD.

This way, ssl-opt.sh and compat.sh work (barring other issues) for all
our reference versions of OpenSSL as well as for a modern system OpenSSL.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>