Blame SOURCES/openssl-1.1.1-servername-cb.patch

b3353e
diff -up openssl-1.1.1k/ssl/statem/statem_lib.c.servername-cb openssl-1.1.1k/ssl/statem/statem_lib.c
b3353e
--- openssl-1.1.1k/ssl/statem/statem_lib.c.servername-cb	2021-07-16 16:03:04.200024170 +0200
b3353e
+++ openssl-1.1.1k/ssl/statem/statem_lib.c	2021-07-16 16:08:04.076630415 +0200
b3353e
@@ -1504,8 +1504,8 @@ static int ssl_method_error(const SSL *s
b3353e
 
b3353e
 /*
b3353e
  * Only called by servers. Returns 1 if the server has a TLSv1.3 capable
b3353e
- * certificate type, or has PSK or a certificate callback configured, or has
b3353e
- * a servername callback configured. Otherwise returns 0.
b3353e
+ * certificate type, or has PSK or a certificate callback configured. Otherwise
b3353e
+ * returns 0.
b3353e
  */
b3353e
 static int is_tls13_capable(const SSL *s)
b3353e
 {
b3353e
@@ -1515,17 +1515,6 @@ static int is_tls13_capable(const SSL *s
b3353e
     EC_KEY *eckey;
b3353e
 #endif
b3353e
 
b3353e
-    if (!ossl_assert(s->ctx != NULL) || !ossl_assert(s->session_ctx != NULL))
b3353e
-        return 0;
b3353e
-
b3353e
-    /*
b3353e
-     * A servername callback can change the available certs, so if a servername
b3353e
-     * cb is set then we just assume TLSv1.3 will be ok
b3353e
-     */
b3353e
-    if (s->ctx->ext.servername_cb != NULL
b3353e
-            || s->session_ctx->ext.servername_cb != NULL)
b3353e
-        return 1;
b3353e
-
b3353e
 #ifndef OPENSSL_NO_PSK
b3353e
     if (s->psk_server_callback != NULL)
b3353e
         return 1;
b3353e
diff -up openssl-1.1.1k/test/sslapitest.c.servername-cb openssl-1.1.1k/test/sslapitest.c
b3353e
--- openssl-1.1.1k/test/sslapitest.c.servername-cb	2021-07-16 16:08:20.094823046 +0200
b3353e
+++ openssl-1.1.1k/test/sslapitest.c	2021-07-16 16:09:25.708612095 +0200
b3353e
@@ -6658,62 +6658,6 @@ static int test_ssl_dup(void)
b3353e
 }
b3353e
 #endif
b3353e
 
b3353e
-#ifndef OPENSSL_NO_TLS1_3
b3353e
-/*
b3353e
- * Test that setting an SNI callback works with TLSv1.3. Specifically we check
b3353e
- * that it works even without a certificate configured for the original
b3353e
- * SSL_CTX
b3353e
- */
b3353e
-static int test_sni_tls13(void)
b3353e
-{
b3353e
-    SSL_CTX *cctx = NULL, *sctx = NULL, *sctx2 = NULL;
b3353e
-    SSL *clientssl = NULL, *serverssl = NULL;
b3353e
-    int testresult = 0;
b3353e
-
b3353e
-    /* Reset callback counter */
b3353e
-    snicb = 0;
b3353e
-
b3353e
-    /* Create an initial SSL_CTX with no certificate configured */
b3353e
-    sctx = SSL_CTX_new(TLS_server_method());
b3353e
-    if (!TEST_ptr(sctx))
b3353e
-        goto end;
b3353e
-    /* Require TLSv1.3 as a minimum */
b3353e
-    if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(),
b3353e
-                                       TLS1_3_VERSION, 0, &sctx2, &cctx, cert,
b3353e
-                                       privkey)))
b3353e
-        goto end;
b3353e
-
b3353e
-    /* Set up SNI */
b3353e
-    if (!TEST_true(SSL_CTX_set_tlsext_servername_callback(sctx, sni_cb))
b3353e
-            || !TEST_true(SSL_CTX_set_tlsext_servername_arg(sctx, sctx2)))
b3353e
-        goto end;
b3353e
-
b3353e
-    /*
b3353e
-     * Connection should still succeed because the final SSL_CTX has the right
b3353e
-     * certificates configured.
b3353e
-     */
b3353e
-    if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
b3353e
-                                      &clientssl, NULL, NULL))
b3353e
-            || !TEST_true(create_ssl_connection(serverssl, clientssl,
b3353e
-                                                SSL_ERROR_NONE)))
b3353e
-        goto end;
b3353e
-
b3353e
-    /* We should have had the SNI callback called exactly once */
b3353e
-    if (!TEST_int_eq(snicb, 1))
b3353e
-        goto end;
b3353e
-
b3353e
-    testresult = 1;
b3353e
-
b3353e
-end:
b3353e
-    SSL_free(serverssl);
b3353e
-    SSL_free(clientssl);
b3353e
-    SSL_CTX_free(sctx2);
b3353e
-    SSL_CTX_free(sctx);
b3353e
-    SSL_CTX_free(cctx);
b3353e
-    return testresult;
b3353e
-}
b3353e
-#endif
b3353e
-
b3353e
 int setup_tests(void)
b3353e
 {
b3353e
     if (!TEST_ptr(certsdir = test_get_argument(0))
b3353e
@@ -6837,9 +6781,6 @@ int setup_tests(void)
b3353e
 #ifndef OPENSSL_NO_TLS1_2
b3353e
     ADD_TEST(test_ssl_dup);
b3353e
 #endif
b3353e
-#ifndef OPENSSL_NO_TLS1_3
b3353e
-    ADD_TEST(test_sni_tls13);
b3353e
-#endif
b3353e
     return 1;
b3353e
 }
b3353e