Don't attempt to set provider params on an ENGINE based cipher (3.1/3.0) #22865
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Confirm that using an ENGINE works as expected with TLS even if it is loaded late (after construction of the SSL_CTX). (cherry picked from commit a9c97da)
If an ENGINE has been loaded after the SSL_CTX has been created then the cipher we have cached might be provider based, but the cipher we actually end up using might not be. Don't try to set provider params on a cipher that is actually ENGINE based.
mattcaswell
added
approval: review pending
t8m
approved these changes
Nov 29, 2023
t8m
removed
the
approval: otc review pending
tmshort
reviewed
Nov 29, 2023
tmshort
approved these changes
Nov 29, 2023
tmshort
added
approval: done
openssl-machine
added
approval: ready to merge
|
This pull request is ready to merge |
|
Pushed to 3.1/3.0. Thanks. |
openssl-machine
pushed a commit
that referenced
this pull request
Dec 12, 2023
If an ENGINE has been loaded after the SSL_CTX has been created then the cipher we have cached might be provider based, but the cipher we actually end up using might not be. Don't try to set provider params on a cipher that is actually ENGINE based. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from #22865)
openssl-machine
pushed a commit
that referenced
this pull request
Dec 12, 2023
If an ENGINE has been loaded after the SSL_CTX has been created then the cipher we have cached might be provider based, but the cipher we actually end up using might not be. Don't try to set provider params on a cipher that is actually ENGINE based. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from #22865) (cherry picked from commit ed5f9ce)
wanghao75
pushed a commit
to openeuler-mirror/openssl
that referenced
this pull request
Dec 15, 2023
Confirm that using an ENGINE works as expected with TLS even if it is loaded late (after construction of the SSL_CTX). (cherry picked from commit a9c97da4910648790387d035afb12963158778fb) Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from openssl/openssl#22865) (cherry picked from commit dda9208cef52670e6c832cbadaa3e08ad535ac30) Signed-off-by: fly2x <fly2x@hitls.org>
wanghao75
pushed a commit
to openeuler-mirror/openssl
that referenced
this pull request
Dec 15, 2023
If an ENGINE has been loaded after the SSL_CTX has been created then the cipher we have cached might be provider based, but the cipher we actually end up using might not be. Don't try to set provider params on a cipher that is actually ENGINE based. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from openssl/openssl#22865) (cherry picked from commit ed5f9ce63e98da2e7fddd55040c8e9e03f3af975) Signed-off-by: fly2x <fly2x@hitls.org>
wanghao75
pushed a commit
to openeuler-mirror/openssl
that referenced
this pull request
Dec 15, 2023
Confirm that using an ENGINE works as expected with TLS even if it is loaded late (after construction of the SSL_CTX). (cherry picked from commit a9c97da4910648790387d035afb12963158778fb) Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from openssl/openssl#22865) Signed-off-by: fly2x <fly2x@hitls.org>
wanghao75
pushed a commit
to openeuler-mirror/openssl
that referenced
this pull request
Dec 15, 2023
If an ENGINE has been loaded after the SSL_CTX has been created then the cipher we have cached might be provider based, but the cipher we actually end up using might not be. Don't try to set provider params on a cipher that is actually ENGINE based. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from openssl/openssl#22865) Signed-off-by: fly2x <fly2x@hitls.org>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
If an ENGINE has been loaded after the SSL_CTX has been created then
the cipher we have cached might be provider based, but the cipher we
actually end up using might not be. Don't try to set provider params on
a cipher that is actually ENGINE based.
We also add a test for this.
This is the 3.1/3.0 backport of #22864