isaacpittman-hitachi / rpms / openssl

Forked from rpms/openssl 2 years ago
Clone

Blame SOURCES/openssl-1.1.1-servername-cb.patch

0c50f5
diff -up openssl-1.1.1k/ssl/statem/statem_lib.c.servername-cb openssl-1.1.1k/ssl/statem/statem_lib.c
0c50f5
--- openssl-1.1.1k/ssl/statem/statem_lib.c.servername-cb	2021-07-16 16:03:04.200024170 +0200
0c50f5
+++ openssl-1.1.1k/ssl/statem/statem_lib.c	2021-07-16 16:08:04.076630415 +0200
0c50f5
@@ -1504,8 +1504,8 @@ static int ssl_method_error(const SSL *s
0c50f5
 
0c50f5
 /*
0c50f5
  * Only called by servers. Returns 1 if the server has a TLSv1.3 capable
0c50f5
- * certificate type, or has PSK or a certificate callback configured, or has
0c50f5
- * a servername callback configured. Otherwise returns 0.
0c50f5
+ * certificate type, or has PSK or a certificate callback configured. Otherwise
0c50f5
+ * returns 0.
0c50f5
  */
0c50f5
 static int is_tls13_capable(const SSL *s)
0c50f5
 {
0c50f5
@@ -1515,17 +1515,6 @@ static int is_tls13_capable(const SSL *s
0c50f5
     EC_KEY *eckey;
0c50f5
 #endif
0c50f5
 
0c50f5
-    if (!ossl_assert(s->ctx != NULL) || !ossl_assert(s->session_ctx != NULL))
0c50f5
-        return 0;
0c50f5
-
0c50f5
-    /*
0c50f5
-     * A servername callback can change the available certs, so if a servername
0c50f5
-     * cb is set then we just assume TLSv1.3 will be ok
0c50f5
-     */
0c50f5
-    if (s->ctx->ext.servername_cb != NULL
0c50f5
-            || s->session_ctx->ext.servername_cb != NULL)
0c50f5
-        return 1;
0c50f5
-
0c50f5
 #ifndef OPENSSL_NO_PSK
0c50f5
     if (s->psk_server_callback != NULL)
0c50f5
         return 1;
0c50f5
diff -up openssl-1.1.1k/test/sslapitest.c.servername-cb openssl-1.1.1k/test/sslapitest.c
0c50f5
--- openssl-1.1.1k/test/sslapitest.c.servername-cb	2021-07-16 16:08:20.094823046 +0200
0c50f5
+++ openssl-1.1.1k/test/sslapitest.c	2021-07-16 16:09:25.708612095 +0200
0c50f5
@@ -6658,62 +6658,6 @@ static int test_ssl_dup(void)
0c50f5
 }
0c50f5
 #endif
0c50f5
 
0c50f5
-#ifndef OPENSSL_NO_TLS1_3
0c50f5
-/*
0c50f5
- * Test that setting an SNI callback works with TLSv1.3. Specifically we check
0c50f5
- * that it works even without a certificate configured for the original
0c50f5
- * SSL_CTX
0c50f5
- */
0c50f5
-static int test_sni_tls13(void)
0c50f5
-{
0c50f5
-    SSL_CTX *cctx = NULL, *sctx = NULL, *sctx2 = NULL;
0c50f5
-    SSL *clientssl = NULL, *serverssl = NULL;
0c50f5
-    int testresult = 0;
0c50f5
-
0c50f5
-    /* Reset callback counter */
0c50f5
-    snicb = 0;
0c50f5
-
0c50f5
-    /* Create an initial SSL_CTX with no certificate configured */
0c50f5
-    sctx = SSL_CTX_new(TLS_server_method());
0c50f5
-    if (!TEST_ptr(sctx))
0c50f5
-        goto end;
0c50f5
-    /* Require TLSv1.3 as a minimum */
0c50f5
-    if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(),
0c50f5
-                                       TLS1_3_VERSION, 0, &sctx2, &cctx, cert,
0c50f5
-                                       privkey)))
0c50f5
-        goto end;
0c50f5
-
0c50f5
-    /* Set up SNI */
0c50f5
-    if (!TEST_true(SSL_CTX_set_tlsext_servername_callback(sctx, sni_cb))
0c50f5
-            || !TEST_true(SSL_CTX_set_tlsext_servername_arg(sctx, sctx2)))
0c50f5
-        goto end;
0c50f5
-
0c50f5
-    /*
0c50f5
-     * Connection should still succeed because the final SSL_CTX has the right
0c50f5
-     * certificates configured.
0c50f5
-     */
0c50f5
-    if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
0c50f5
-                                      &clientssl, NULL, NULL))
0c50f5
-            || !TEST_true(create_ssl_connection(serverssl, clientssl,
0c50f5
-                                                SSL_ERROR_NONE)))
0c50f5
-        goto end;
0c50f5
-
0c50f5
-    /* We should have had the SNI callback called exactly once */
0c50f5
-    if (!TEST_int_eq(snicb, 1))
0c50f5
-        goto end;
0c50f5
-
0c50f5
-    testresult = 1;
0c50f5
-
0c50f5
-end:
0c50f5
-    SSL_free(serverssl);
0c50f5
-    SSL_free(clientssl);
0c50f5
-    SSL_CTX_free(sctx2);
0c50f5
-    SSL_CTX_free(sctx);
0c50f5
-    SSL_CTX_free(cctx);
0c50f5
-    return testresult;
0c50f5
-}
0c50f5
-#endif
0c50f5
-
0c50f5
 int setup_tests(void)
0c50f5
 {
0c50f5
     if (!TEST_ptr(certsdir = test_get_argument(0))
0c50f5
@@ -6837,9 +6781,6 @@ int setup_tests(void)
0c50f5
 #ifndef OPENSSL_NO_TLS1_2
0c50f5
     ADD_TEST(test_ssl_dup);
0c50f5
 #endif
0c50f5
-#ifndef OPENSSL_NO_TLS1_3
0c50f5
-    ADD_TEST(test_sni_tls13);
0c50f5
-#endif
0c50f5
     return 1;
0c50f5
 }
0c50f5