diff options
| author | Matt Caswell <matt@openssl.org> | 2023-11-29 11:45:12 +0000 |
|---|---|---|
| committer | Matt Caswell <matt@openssl.org> | 2023-12-12 16:20:21 +0000 |
| commit | 4f41e1b1d0cd545278017099b4ba062ab7a0f470 (patch) | |
| tree | eaf8bbb4b7f33ee3043c72e18a1fd77fe3833ef8 | |
| parent | 9ffd4a34681feb9968719905b366276e7425e2a2 (diff) | |
Don't attempt to set provider params on an ENGINE based cipher
If an ENGINE has been loaded after the SSL_CTX has been created then
the cipher we have cached might be provider based, but the cipher we
actually end up using might not be. Don't try to set provider params on
a cipher that is actually ENGINE based.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/22865)
(cherry picked from commit ed5f9ce63e98da2e7fddd55040c8e9e03f3af975)
| -rw-r--r-- | ssl/s3_enc.c | 6 | ||||
| -rw-r--r-- | ssl/t1_enc.c | 7 |
2 files changed, 11 insertions, 2 deletions
diff --git a/ssl/s3_enc.c b/ssl/s3_enc.c index 2ca3f74ae7..ee4f58e75e 100644 --- a/ssl/s3_enc.c +++ b/ssl/s3_enc.c @@ -225,7 +225,11 @@ int ssl3_change_cipher_state(SSL *s, int which) goto err; } - if (EVP_CIPHER_get0_provider(c) != NULL + /* + * The cipher we actually ended up using in the EVP_CIPHER_CTX may be + * different to that in c if we have an ENGINE in use + */ + if (EVP_CIPHER_get0_provider(EVP_CIPHER_CTX_get0_cipher(dd)) != NULL && !tls_provider_set_tls_params(s, dd, c, m)) { /* SSLfatal already called */ goto err; diff --git a/ssl/t1_enc.c b/ssl/t1_enc.c index 91238e6457..6cb7baaf7c 100644 --- a/ssl/t1_enc.c +++ b/ssl/t1_enc.c @@ -427,7 +427,12 @@ int tls1_change_cipher_state(SSL *s, int which) SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); goto err; } - if (EVP_CIPHER_get0_provider(c) != NULL + + /* + * The cipher we actually ended up using in the EVP_CIPHER_CTX may be + * different to that in c if we have an ENGINE in use + */ + if (EVP_CIPHER_get0_provider(EVP_CIPHER_CTX_get0_cipher(dd)) != NULL && !tls_provider_set_tls_params(s, dd, c, m)) { /* SSLfatal already called */ goto err; |