Blame SOURCES/0003-curl-7.61.1-TLS-1.3-PHA.patch

ecbd30
From bb8ad3da3fb4ab3f6556daa1f67b259c12a3c7de Mon Sep 17 00:00:00 2001
ecbd30
From: Christian Heimes <christian@python.org>
ecbd30
Date: Fri, 21 Sep 2018 10:37:43 +0200
ecbd30
Subject: [PATCH] OpenSSL: enable TLS 1.3 post-handshake auth
ecbd30
ecbd30
OpenSSL 1.1.1 requires clients to opt-in for post-handshake
ecbd30
authentication.
ecbd30
ecbd30
Fixes: https://github.com/curl/curl/issues/3026
ecbd30
Signed-off-by: Christian Heimes <christian@python.org>
ecbd30
ecbd30
Closes https://github.com/curl/curl/pull/3027
ecbd30
ecbd30
Upstream-commit: b939bc47b27cd57c6ebb852ad653933e4124b452
ecbd30
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
ecbd30
---
ecbd30
 lib/vtls/openssl.c | 6 ++++++
ecbd30
 1 file changed, 6 insertions(+)
ecbd30
ecbd30
diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c
ecbd30
index a487f55..78970d1 100644
ecbd30
--- a/lib/vtls/openssl.c
ecbd30
+++ b/lib/vtls/openssl.c
ecbd30
@@ -178,6 +178,7 @@ static unsigned long OpenSSL_version_num(void)
ecbd30
      !defined(LIBRESSL_VERSION_NUMBER) &&       \
ecbd30
      !defined(OPENSSL_IS_BORINGSSL))
ecbd30
 #define HAVE_SSL_CTX_SET_CIPHERSUITES
ecbd30
+#define HAVE_SSL_CTX_SET_POST_HANDSHAKE_AUTH
ecbd30
 #endif
ecbd30
 
ecbd30
 #if defined(LIBRESSL_VERSION_NUMBER)
ecbd30
@@ -2467,6 +2468,11 @@ static CURLcode ossl_connect_step1(struct connectdata *conn, int sockindex)
ecbd30
   }
ecbd30
 #endif
ecbd30
 
ecbd30
+#ifdef HAVE_SSL_CTX_SET_POST_HANDSHAKE_AUTH
ecbd30
+  /* OpenSSL 1.1.1 requires clients to opt-in for PHA */
ecbd30
+  SSL_CTX_set_post_handshake_auth(BACKEND->ctx, 1);
ecbd30
+#endif
ecbd30
+
ecbd30
 #ifdef USE_TLS_SRP
ecbd30
   if(ssl_authtype == CURL_TLSAUTH_SRP) {
ecbd30
     char * const ssl_username = SSL_SET_OPTION(username);
ecbd30
-- 
ecbd30
2.17.1
ecbd30