diff -up vsftpd-3.0.2/parseconf.c.ecdh vsftpd-3.0.2/parseconf.c

--- vsftpd-3.0.2/parseconf.c.ecdh	2014-06-04 10:25:36.786735755 +0200

+++ vsftpd-3.0.2/parseconf.c	2014-06-04 10:25:36.812735747 +0200

@@ -176,6 +176,7 @@ parseconf_str_array[] =

   { "rsa_cert_file", &tunable_rsa_cert_file },

   { "dsa_cert_file", &tunable_dsa_cert_file },

   { "dh_param_file", &tunable_dh_param_file },

+  { "ecdh_param_file", &tunable_ecdh_param_file },

   { "ssl_ciphers", &tunable_ssl_ciphers },

   { "rsa_private_key_file", &tunable_rsa_private_key_file },

   { "dsa_private_key_file", &tunable_dsa_private_key_file },

diff -up vsftpd-3.0.2/ssl.c.ecdh vsftpd-3.0.2/ssl.c

--- vsftpd-3.0.2/ssl.c.ecdh	2014-06-04 10:25:36.786735755 +0200

+++ vsftpd-3.0.2/ssl.c	2014-06-04 10:25:36.812735747 +0200

@@ -122,7 +122,7 @@ ssl_init(struct vsf_session* p_sess)

     {

       die("SSL: could not allocate SSL context");

     }

-    options = SSL_OP_ALL | SSL_OP_SINGLE_DH_USE;

+    options = SSL_OP_ALL | SSL_OP_SINGLE_DH_USE | SSL_OP_SINGLE_ECDH_USE;

     if (!tunable_sslv2)

     {

       options |= SSL_OP_NO_SSLv2;

@@ -235,6 +235,41 @@ ssl_init(struct vsf_session* p_sess)

     SSL_CTX_set_tmp_dh_callback(p_ctx, ssl_tmp_dh_callback);

+    if (tunable_ecdh_param_file)

+    {

+      BIO *bio;

+      int nid;

+      EC_GROUP *ecparams = NULL;

+      EC_KEY *eckey;

+

+      if ((bio = BIO_new_file(tunable_ecdh_param_file, "r")) == NULL)

+        die("SSL: cannot load custom ec params");

+      else

+      {

+        ecparams = PEM_read_bio_ECPKParameters(bio, NULL, NULL, NULL);

+        BIO_free(bio);

+

+        if (ecparams && (nid = EC_GROUP_get_curve_name(ecparams)) &&

+            (eckey = EC_KEY_new_by_curve_name(nid)))

+        {

+          if (!SSL_CTX_set_tmp_ecdh(p_ctx, eckey))

+            die("SSL: setting custom EC params failed");

+	}

+	else

+        {

+          die("SSL: getting ec group or key failed");

+	}

+      }

+    }

+    else

+    {

+#if defined(SSL_CTX_set_ecdh_auto)

+      SSL_CTX_set_ecdh_auto(p_ctx, 1);

+#else

+      SSL_CTX_set_tmp_ecdh(p_ctx, EC_KEY_new_by_curve_name(NID_X9_62_prime256v1));

+#endif

+    }

+

     p_sess->p_ssl_ctx = p_ctx;

     ssl_inited = 1;

   }

diff -up vsftpd-3.0.2/tunables.c.ecdh vsftpd-3.0.2/tunables.c

--- vsftpd-3.0.2/tunables.c.ecdh	2014-06-04 10:25:36.787735755 +0200

+++ vsftpd-3.0.2/tunables.c	2014-06-04 10:25:36.813735747 +0200

@@ -140,6 +140,7 @@ const char* tunable_email_password_file;

 const char* tunable_rsa_cert_file;

 const char* tunable_dsa_cert_file;

 const char* tunable_dh_param_file;

+const char* tunable_ecdh_param_file;

 const char* tunable_ssl_ciphers;

 const char* tunable_rsa_private_key_file;

 const char* tunable_dsa_private_key_file;

@@ -288,7 +289,8 @@ tunables_load_defaults()

                       &tunable_rsa_cert_file);

   install_str_setting(0, &tunable_dsa_cert_file);

   install_str_setting(0, &tunable_dh_param_file);

-  install_str_setting("AES128-SHA:DES-CBC3-SHA:DHE-RSA-AES256-SHA",

+  install_str_setting(0, &tunable_ecdh_param_file);

+  install_str_setting("AES128-SHA:DES-CBC3-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA",

                       &tunable_ssl_ciphers);

   install_str_setting(0, &tunable_rsa_private_key_file);

   install_str_setting(0, &tunable_dsa_private_key_file);

diff -up vsftpd-3.0.2/tunables.h.ecdh vsftpd-3.0.2/tunables.h

--- vsftpd-3.0.2/tunables.h.ecdh	2014-06-04 10:25:36.787735755 +0200

+++ vsftpd-3.0.2/tunables.h	2014-06-04 10:25:36.813735747 +0200

@@ -142,6 +142,7 @@ extern const char* tunable_email_passwor

 extern const char* tunable_rsa_cert_file;

 extern const char* tunable_dsa_cert_file;

 extern const char* tunable_dh_param_file;

+extern const char* tunable_ecdh_param_file;

 extern const char* tunable_ssl_ciphers;

 extern const char* tunable_rsa_private_key_file;

 extern const char* tunable_dsa_private_key_file;

diff -up vsftpd-3.0.2/vsftpd.conf.5.ecdh vsftpd-3.0.2/vsftpd.conf.5

--- vsftpd-3.0.2/vsftpd.conf.5.ecdh	2014-06-04 10:25:36.787735755 +0200

+++ vsftpd-3.0.2/vsftpd.conf.5	2014-06-04 10:25:36.813735747 +0200

@@ -890,6 +890,14 @@ ephemeral Diffie-Hellman key exchange in

 Default: (none - use built in parameters appropriate for certificate key size)

 .TP

+.B ecdh_param_file

+This option specifies the location of custom parameters for ephemeral

+Elliptic Curve Diffie-Hellman (ECDH) key exchange.

+

+Default: (none - use built in parameters, NIST P-256 with OpenSSL 1.0.1 and

+automatically selected curve based on client preferences with OpenSSL 1.0.2

+and later)

+.TP

 .B email_password_file

 This option can be used to provide an alternate file for usage by the

 .BR secure_email_list_enable