Bladeren bron

mbedtls: enable DHE-RSA key exchange

Later OpenVPN 2.3-openssl versions only enable
TLS cipher suites with perfect forward secrecy, i.e. DHE and ECDHE
cipher suites. ECDHE key exchange is not supported by
OpenVPN 2.3-openssl, enable DHE key exchange to allow LEDE
OpenVPN 2.4-mbedtls clients to connect to such servers.

Signed-off-by: Magnus Kroken <[email protected]>
Reported-by: Martin Blumenstingl <[email protected]>
Reported-by: Lucian Cristian <[email protected]>
Magnus Kroken 8 jaren geleden
bovenliggende
commit
8ed11ebf7d
1 gewijzigde bestanden met toevoegingen van 0 en 9 verwijderingen
  1. 0 9
      package/libs/mbedtls/patches/200-config.patch

+ 0 - 9
package/libs/mbedtls/patches/200-config.patch

@@ -82,15 +82,6 @@
  
  /**
   * \def MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
-@@ -622,7 +622,7 @@
-  *      MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA
-  *      MBEDTLS_TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
-  */
--#define MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED
-+//#define MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED
- 
- /**
-  * \def MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
 @@ -695,7 +695,7 @@
   *      MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256
   *      MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384