From 332beb27d86c8e1a6220c2ccfc9e54b57d299e02 Mon Sep 17 00:00:00 2001 From: Alexander Traud Date: Wed, 22 Jun 2016 14:13:39 +0200 Subject: res_rtp_asterisk: Enable Forward Secrecy (PFS) for DTLS. Since July 2014, TLS based protocols (SIP over TLS, Secure WebSockets, HTTPS) support PFS thanks to ASTERISK-23905. In July 2015, the same feature was added for DTLS. The source code from main/tcptls.c should have been re-used to ease security audits. Therefore, this change rolls back the change from July 2015 and re-uses the code from July 2014. This has the additional benefits to work under CentOS 7 and enabling not just ECDHE but DHE based cipher suites as well. ASTERISK-25659 #close Reported by: StefanEng86, urbaniak, pay123 Tested by: sarumjanuch, traud patches: res_rtp_asterisk.patch submitted by sarumjanuch dtls_centos_step_1.patch submitted by traud dtls_centos_step_2.patch submitted by traud Change-Id: I537cadf4421f092a613146b230f2c0ee1be28d5c --- include/asterisk/autoconfig.h.in | 3 --- 1 file changed, 3 deletions(-) (limited to 'include') diff --git a/include/asterisk/autoconfig.h.in b/include/asterisk/autoconfig.h.in index 8f02ee572..6c7ae6b32 100644 --- a/include/asterisk/autoconfig.h.in +++ b/include/asterisk/autoconfig.h.in @@ -548,9 +548,6 @@ /* Define to 1 if CRYPTO has the OpenSSL Elliptic Curve Support feature. */ #undef HAVE_OPENSSL_EC -/* Define if your system has SSL_CTX_set_ecdh_auto declared. */ -#undef HAVE_OPENSSL_ECDH_AUTO - /* Define to 1 if CRYPTO has the OpenSSL SRTP Extension Support feature. */ #undef HAVE_OPENSSL_SRTP -- cgit v1.2.3