From: William Lallemand <wlallemand@irq6.net>
Date: Tue, 6 Oct 2026 11:51:45 +0000 (+0200)
Subject: BUG/MINOR: ssl: use standard names for X25519 and X448 groups
X-Git-Tag: v3.5-dev9~189
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=5b19cde53bdf5188364eed3e61d8c51e1af47adf;p=haproxy.git

BUG/MINOR: ssl: use standard names for X25519 and X448 groups

The curve table uses ecdh_x25519 and ecdh_x448, which are OpenSSL TLS1.3
draft11 name labels rather than the released group names registered at
IANA. As a result, SSL traces print those labels and curves2nid() cannot
resolve x25519 or x448 even when the corresponding NID is available.

Use x25519 and x448 as the primary names. Keep the old ecdh_* strings
as aliases at the end of the table so existing name-to-NID lookups
continue to work. The aliases must follow the standard names because
curveid2str() returns the first entry matching a group identifier.

curveid2str() is only used in the traces so there's no fonctionnal
changes.

This should be backported to 3.3 and 3.4, which contain the curve table
introduced by d799a1b3b (MINOR: ssl: Add curve id to curve name table
and mapping functions).
---

diff --git a/src/ssl_utils.c b/src/ssl_utils.c
index e48486906..db623f220 100644
--- a/src/ssl_utils.c
+++ b/src/ssl_utils.c
@@ -1050,8 +1050,8 @@ static struct curve {
 	V( 26,     NID_brainpoolP256r1,                      "brainpoolP256r1",       NULL       ),
 	V( 27,     NID_brainpoolP384r1,                      "brainpoolP384r1",       NULL       ),
 	V( 28,     NID_brainpoolP512r1,                      "brainpoolP512r1",       NULL       ),
-	V( 29,     NID_X25519,                               "ecdh_x25519",           NULL       ),
-	V( 30,     NID_X448,                                 "ecdh_x448",             NULL       ),
+	V( 29,     NID_X25519,                               "x25519",                NULL       ),
+	V( 30,     NID_X448,                                 "x448",                  NULL       ),
 	V( 31,     NID_brainpoolP256r1tls13,                 "brainpoolP256r1tls13",  NULL       ),
 	V( 32,     NID_brainpoolP384r1tls13,                 "brainpoolP384r1tls13",  NULL       ),
 	V( 33,     NID_brainpoolP512r1tls13,                 "brainpoolP512r1tls13",  NULL       ),
@@ -1076,6 +1076,12 @@ static struct curve {
 	V( 25498,  -1,                                       "SecP256r1Kyber768Draft00",        NULL ),
 	V( 0xFF01, -1,                                       "arbitrary_explicit_prime_curves", NULL ),
 	V( 0xFF02, -1,                                       "arbitrary_explicit_char2_curves", NULL ),
+	/* Keep the old OpenSSL trace labels as aliases for name-to-NID lookup.
+	 * These must follow the standard names above, since curveid2str()
+	 * returns the first entry matching the TLS group identifier.
+	 */
+	V( 29,     NID_X25519,                               "ecdh_x25519",           NULL       ),
+	V( 30,     NID_X448,                                 "ecdh_x448",             NULL       ),
 	{ 0, 0, NULL, NULL, NULL }
 };