From 85212f2799bfda8b40f9261de6a874e0f7c77428 Mon Sep 17 00:00:00 2001 From: Alexander Traud Date: Wed, 22 Jun 2016 14:13:39 +0200 Subject: res_rtp_asterisk: Enable Forward Secrecy (PFS) for DTLS. Since July 2014, TLS based protocols (SIP over TLS, Secure WebSockets, HTTPS) support PFS thanks to ASTERISK-23905. In July 2015, the same feature was added for DTLS. The source code from main/tcptls.c should have been re-used to ease security audits. Therefore, this change rolls back the change from July 2015 and re-uses the code from July 2014. This has the additional benefits to work under CentOS 7 and enabling not just ECDHE but DHE based cipher suites as well. ASTERISK-25659 #close Reported by: StefanEng86, urbaniak, pay123 Tested by: sarumjanuch, traud patches: res_rtp_asterisk.patch submitted by sarumjanuch dtls_centos_step_1.patch submitted by traud dtls_centos_step_2.patch submitted by traud Change-Id: I537cadf4421f092a613146b230f2c0ee1be28d5c --- include/asterisk/autoconfig.h.in | 3 --- 1 file changed, 3 deletions(-) (limited to 'include/asterisk/autoconfig.h.in') diff --git a/include/asterisk/autoconfig.h.in b/include/asterisk/autoconfig.h.in index cdcc4d006..5cd0acd66 100644 --- a/include/asterisk/autoconfig.h.in +++ b/include/asterisk/autoconfig.h.in @@ -547,9 +547,6 @@ /* Define to 1 if CRYPTO has the OpenSSL Elliptic Curve Support feature. */ #undef HAVE_OPENSSL_EC -/* Define if your system has SSL_CTX_set_ecdh_auto declared. */ -#undef HAVE_OPENSSL_ECDH_AUTO - /* Define to 1 if CRYPTO has the OpenSSL SRTP Extension Support feature. */ #undef HAVE_OPENSSL_SRTP -- cgit v1.2.3