rpms/librelp
7
0
Fork 0
Code Issues Pull Requests Releases Activity

backport: fix SSL_CONF_cmd/SSL_new ordering in OpenSSL client connect path

Browse Source 
Backport https://github.com/rsyslog/librelp/pull/291

Resolves: RHEL-188813
Signed-off-by: Cropi <alakatos@redhat.com>
This commit is contained in:
Cropi 2026-07-09 10:10:59 +02:00
parent 0982e58ece
commit 517f1432d6
2 changed files with 77 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

64
fix-ossl-ssl-new-ordering.patch Normal file
View File

@ -0,0 +1,64 @@
From 9bf89ca142bc89d5bf29fc9a437187dd0bffaaa9 Mon Sep 17 00:00:00 2001
From: Cropi <alakatos@redhat.com>
Date: Wed, 24 Jun 2026 13:07:05 +0200
Subject: [PATCH] tcp: fix SSL_CONF_cmd/SSL_new ordering in OpenSSL client
connect path
relpTcpConnectTLSInit_ossl() called SSL_new(ctx) before
relpTcpSetSslConfCmd_ossl(), so SSL_CONF_cmd("Groups", ...) applied via
tls.tlscfgcmd was updating the SSL_CTX after the SSL object had already
captured its group list. On OpenSSL 3.x this caused the client to
advertise the full default group set (including X25519MLKEM768 on 3.5+)
regardless of any Groups restriction in tlsConfigCmd.
Move pThis->sslState = osslClient and relpTcpSetSslConfCmd_ossl() to
before SSL_new() so the SSL object inherits the correctly configured
SSL_CTX. relpTcpTLSSetPrio() stays after SSL_new() because it operates
on pThis->ssl via SSL_set_cipher_list().
The server listen path (relpTcpLstnInitTLS_ossl) already applied
SSL_CONF_cmd to the SSL_CTX before any SSL_new() calls; this brings the
client connect path into the same order.
Signed-off-by: Cropi <alakatos@redhat.com>
---
src/tcp.c | 15 +++++++++------
1 file changed, 9 insertions(+), 6 deletions(-)
diff --git a/src/tcp.c b/src/tcp.c
--- a/src/tcp.c
+++ b/src/tcp.c
@@ -1879,6 +1879,15 @@
/*if we reach this point we are in tls mode */
pThis->pEngine->dbgprint((char*)"relpTcpConnectTLSInit: TLS Mode\n");
+ /* set before relpTcpSetSslConfCmd_ossl: tlsConfigCmd may contain
+ * flag-restricted commands that require SSL_CONF_FLAG_CLIENT */
+ pThis->sslState = osslClient;
+
+ /* SSL_CONF_cmd targets the SSL_CTX; SSL_new() snapshots the SSL_CTX's
+ * group list at construction time, so this must run before SSL_new()
+ * or the SSL object keeps the default groups set by SSL_CTX_new() */
+ CHKRet(relpTcpSetSslConfCmd_ossl(pThis, pThis->tlsConfigCmd));
+
if(!(pThis->ssl = SSL_new(ctx))) {
relpTcpLastSSLErrorMsg(0, pThis, "relpTcpConnectTLSInit");
ABORT_FINALIZE(RELP_RET_IO_ERR);
@@ -1894,17 +1903,11 @@
} else
pThis->authmode = eRelpAuthMode_None;
- /* Set TLS Options if configured */
- CHKRet(relpTcpSetSslConfCmd_ossl(pThis, pThis->tlsConfigCmd));
-
/* Set TLS Priority Options */
CHKRet(relpTcpTLSSetPrio(pThis));
SSL_set_ex_data(pThis->ssl, 0, (void*)pThis);
- /*set client state */
- pThis->sslState = osslClient;
-
/* Create BIO from ptcp socket! */
conn = BIO_new_socket(pThis->sock, BIO_NOCLOSE);
pThis->pEngine->dbgprint((char*)"relpTcpConnectTLSInit: Init conn BIO[%p] done\n", (void *)conn);

19
librelp.spec
View File

@ -1,13 +1,14 @@
Summary: The Reliable Event Logging Protocol library
Name: librelp
Version: 1.11.0
Release: 8%{?dist}
Release: 9%{?dist}
License: GPL-3.0-or-later
URL: http://www.rsyslog.com/
Source0: http://download.rsyslog.com/%{name}/%{name}-%{version}.tar.gz
Patch0: disable-openssl-engine.patch
Patch1: fix-openssl-fd-double-close.patch
Patch2: fix-ossl-ssl-new-ordering.patch
%description
Librelp is an easy to use library for the RELP protocol. RELP (stands
@ -35,6 +36,7 @@ to develop applications using librelp.
%patch -P 0 -p1
%patch -P 1 -p1
%patch -P 2 -p1
%build
autoreconf -ivf
@ -59,9 +61,14 @@ rm $RPM_BUILD_ROOT/%{_libdir}/*.la
%{_libdir}/pkgconfig/relp.pc
%changelog
* Thu Jul 09 2026 Attila Lakatos <alakatos@redhat.com> - 1.11.0-9
- Backport: fix SSL_CONF_cmd/SSL_new ordering in OpenSSL client connect path
Resolves: RHEL-188813
* Thu Jul 09 2026 Attila Lakatos <alakatos@redhat.com> - 1.11.0-8
- Backport: fix OpenSSL fd double-close in TLS teardown
Resolves: RHEL-191751
* Tue Oct 29 2024 Troy Dawson <tdawson@redhat.com> - 1.11.0-7
- Bump release for October 2024 mass rebuild:
Resolves: RHEL-64018
@ -204,22 +211,22 @@ rm $RPM_BUILD_ROOT/%{_libdir}/*.la
* Wed Nov 21 2012 Tomas Heinrich <theinric@redhat.com> - 1.0.1-1
- upgrade to upstream version 1.0.1
* Thu Jul 19 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.0.0-4
* Thu Jul 19 2012 Fedora Release Engineering <releng@fedoraproject.org> - 1.0.0-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
* Fri Jan 13 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.0.0-3
* Fri Jan 13 2012 Fedora Release Engineering <releng@fedoraproject.org> - 1.0.0-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
* Tue Feb 08 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.0.0-2
* Tue Feb 08 2011 Fedora Release Engineering <releng@fedoraproject.org> - 1.0.0-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
* Thu Jul 15 2010 Tomas Heinrich <theinric@redhat.com> - 1.0.0-1
- upgrade to upstream version 1.0.0
* Sat Jul 25 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.1.1-4
* Sat Jul 25 2009 Fedora Release Engineering <releng@fedoraproject.org> - 0.1.1-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
* Wed Feb 25 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.1.1-3
* Wed Feb 25 2009 Fedora Release Engineering <releng@fedoraproject.org> - 0.1.1-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
* Wed May 7 2008 Tomas Heinrich <theinric@redhat.com> 0.1.1-2