60 lines
2.0 KiB
Diff
60 lines
2.0 KiB
Diff
|
From 4f41e1b1d0cd545278017099b4ba062ab7a0f470 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Matt Caswell <matt@openssl.org>
|
||
|
|
Date: Wed, 29 Nov 2023 11:45:12 +0000
|
||
|
|
Subject: [PATCH] Don't attempt to set provider params on an ENGINE based
|
||
|
|
cipher
|
||
|
|
|
||
|
|
If an ENGINE has been loaded after the SSL_CTX has been created then
|
||
|
|
the cipher we have cached might be provider based, but the cipher we
|
||
|
|
actually end up using might not be. Don't try to set provider params on
|
||
|
|
a cipher that is actually ENGINE based.
|
||
|
|
|
||
|
|
Reviewed-by: Tomas Mraz <tomas@openssl.org>
|
||
|
|
Reviewed-by: Todd Short <todd.short@me.com>
|
||
|
|
(Merged from https://github.com/openssl/openssl/pull/22865)
|
||
|
|
|
||
|
|
(cherry picked from commit ed5f9ce63e98da2e7fddd55040c8e9e03f3af975)
|
||
|
|
---
|
||
|
|
ssl/s3_enc.c | 6 +++++-
|
||
|
|
ssl/t1_enc.c | 7 ++++++-
|
||
|
|
2 files changed, 11 insertions(+), 2 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/ssl/s3_enc.c b/ssl/s3_enc.c
|
||
|
|
index 2ca3f74ae7..ee4f58e75e 100644
|
||
|
|
--- a/ssl/s3_enc.c
|
||
|
|
+++ b/ssl/s3_enc.c
|
||
|
|
@@ -225,7 +225,11 @@ int ssl3_change_cipher_state(SSL *s, int which)
|
||
|
|
goto err;
|
||
|
|
}
|
||
|
|
|
||
|
|
- if (EVP_CIPHER_get0_provider(c) != NULL
|
||
|
|
+ /*
|
||
|
|
+ * The cipher we actually ended up using in the EVP_CIPHER_CTX may be
|
||
|
|
+ * different to that in c if we have an ENGINE in use
|
||
|
|
+ */
|
||
|
|
+ if (EVP_CIPHER_get0_provider(EVP_CIPHER_CTX_get0_cipher(dd)) != NULL
|
||
|
|
&& !tls_provider_set_tls_params(s, dd, c, m)) {
|
||
|
|
/* SSLfatal already called */
|
||
|
|
goto err;
|
||
|
|
diff --git a/ssl/t1_enc.c b/ssl/t1_enc.c
|
||
|
|
index 91238e6457..6cb7baaf7c 100644
|
||
|
|
--- a/ssl/t1_enc.c
|
||
|
|
+++ b/ssl/t1_enc.c
|
||
|
|
@@ -427,7 +427,12 @@ int tls1_change_cipher_state(SSL *s, int which)
|
||
|
|
SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
|
||
|
|
goto err;
|
||
|
|
}
|
||
|
|
- if (EVP_CIPHER_get0_provider(c) != NULL
|
||
|
|
+
|
||
|
|
+ /*
|
||
|
|
+ * The cipher we actually ended up using in the EVP_CIPHER_CTX may be
|
||
|
|
+ * different to that in c if we have an ENGINE in use
|
||
|
|
+ */
|
||
|
|
+ if (EVP_CIPHER_get0_provider(EVP_CIPHER_CTX_get0_cipher(dd)) != NULL
|
||
|
|
&& !tls_provider_set_tls_params(s, dd, c, m)) {
|
||
|
|
/* SSLfatal already called */
|
||
|
|
goto err;
|
||
|
|
--
|
||
|
|
2.33.0
|
||
|
|
|