From 1480c7309ba3d934d5faedc4986e57d0a92cf1b6 Mon Sep 17 00:00:00 2001
From: Sadie Powell
Date: Wed, 22 Oct 2025 23:27:00 +0100
Subject: Add better support for multiple TLS groups.

- Rename <sslprofile:ecdhgroups> to <sslprofile:groups>. As of TLS
  1.3 there are non-ECDH groups that can be used here

- Switch the default to X25519MLKEM768:X25519:prime256v1 from just
  prime256v1.

- Add <openssl:strictgroups> to allow only enabling supported groups
  similar to <gnutls:strictpriority>.

- Get rid of an obsolete check for ECDH support.
---
 src/modules/extra/m_ssl_openssl.cpp | 38 ++++++++++++++++++++++++++++---------
 1 file changed, 29 insertions(+), 9 deletions(-)

diff --git a/src/modules/extra/m_ssl_openssl.cpp b/src/modules/extra/m_ssl_openssl.cpp
index 604c1f73f..adb1fce34 100644
--- a/src/modules/extra/m_ssl_openssl.cpp
+++ b/src/modules/extra/m_ssl_openssl.cpp
@@ -62,6 +62,8 @@
 # define INSPIRCD_OPENSSL_AUTO_DH
 #endif
 
+#define INSPIRCD_OPENSSL_DEFAULT_GROUPS "X25519MLKEM768:X25519:prime256v1";
+
 static bool SelfSigned = false;
 static int exdataindex;
 static Module* thismod;
@@ -161,14 +163,30 @@ namespace OpenSSL
 			return (SSL_CTX_set_tmp_dh(ctx, dh.get()) >= 0);
 		}
 #endif
-
-#ifndef OPENSSL_NO_ECDH
-		bool SetECDH(const std::string& grouplist)
+		bool SetGroups(const std::string& groups, bool strictgroups)
 		{
+			std::string grouplist;
+			if (strictgroups)
+				grouplist = groups;
+			else
+			{
+				irc::sepstream groupstream(groups, ':');
+				for (std::string group; groupstream.GetToken(group); )
+				{
+					if (OBJ_sn2nid(group.c_str()) == NID_undef)
+						continue;
+
+					grouplist.append(grouplist.empty() ? "" : ":");
+					grouplist.append(group);
+				}
+
+				ServerInstance->Logs.Debug(MODNAME, "Relaxed groups from {} to {}",
+					groups, grouplist);
+			}
+
 			ERR_clear_error();
 			return SSL_CTX_set1_groups_list(ctx, grouplist.c_str());
 		}
-#endif
 
 		bool SetCiphers(const std::string& ciphers)
 		{
@@ -408,14 +426,16 @@ namespace OpenSSL
 				}
 			}
 
-#ifndef OPENSSL_NO_ECDH
-			const auto grouplist = tag->getString("ecdhgroups", tag->getString("ecdhcurve", "prime256v1"));
-			if (!grouplist.empty() && !ctx.SetECDH(grouplist))
+			std::string grouplist = INSPIRCD_OPENSSL_DEFAULT_GROUPS;
+			auto strictgroups = tag->readString("groups", grouplist);
+			if (!strictgroups)
+				strictgroups = tag->readString("ecdhcurve", grouplist);
+
+			if (!grouplist.empty() && !ctx.SetGroups(grouplist, tag->getBool("strictgroups", strictgroups)))
 			{
 				ERR_print_errors_cb(error_callback, this);
-				throw Exception("Couldn't set ECDH groups: " + lasterr);
+				throw Exception("Couldn't set groups: " + lasterr);
 			}
-#endif
 
 			SetContextOptions("server", tag, ctx);
 			SetContextOptions("client", tag, clientctx);
-- 
cgit v1.3.1-10-gc9f91