From 517f1432d6a20afb575872722b379d155919a263 Mon Sep 17 00:00:00 2001 From: Cropi Date: Thu, 9 Jul 2026 10:10:59 +0200 Subject: [PATCH] backport: fix SSL_CONF_cmd/SSL_new ordering in OpenSSL client connect path Backport https://github.com/rsyslog/librelp/pull/291 Resolves: RHEL-188813 Signed-off-by: Cropi --- fix-ossl-ssl-new-ordering.patch | 64 +++++++++++++++++++++++++++++++++ librelp.spec | 19 ++++++---- 2 files changed, 77 insertions(+), 6 deletions(-) create mode 100644 fix-ossl-ssl-new-ordering.patch diff --git a/fix-ossl-ssl-new-ordering.patch b/fix-ossl-ssl-new-ordering.patch new file mode 100644 index 0000000..67e0f4e --- /dev/null +++ b/fix-ossl-ssl-new-ordering.patch @@ -0,0 +1,64 @@ +From 9bf89ca142bc89d5bf29fc9a437187dd0bffaaa9 Mon Sep 17 00:00:00 2001 +From: Cropi +Date: Wed, 24 Jun 2026 13:07:05 +0200 +Subject: [PATCH] tcp: fix SSL_CONF_cmd/SSL_new ordering in OpenSSL client + connect path + +relpTcpConnectTLSInit_ossl() called SSL_new(ctx) before +relpTcpSetSslConfCmd_ossl(), so SSL_CONF_cmd("Groups", ...) applied via +tls.tlscfgcmd was updating the SSL_CTX after the SSL object had already +captured its group list. On OpenSSL 3.x this caused the client to +advertise the full default group set (including X25519MLKEM768 on 3.5+) +regardless of any Groups restriction in tlsConfigCmd. + +Move pThis->sslState = osslClient and relpTcpSetSslConfCmd_ossl() to +before SSL_new() so the SSL object inherits the correctly configured +SSL_CTX. relpTcpTLSSetPrio() stays after SSL_new() because it operates +on pThis->ssl via SSL_set_cipher_list(). + +The server listen path (relpTcpLstnInitTLS_ossl) already applied +SSL_CONF_cmd to the SSL_CTX before any SSL_new() calls; this brings the +client connect path into the same order. + +Signed-off-by: Cropi +--- + src/tcp.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +diff --git a/src/tcp.c b/src/tcp.c +--- a/src/tcp.c ++++ b/src/tcp.c +@@ -1879,6 +1879,15 @@ + /*if we reach this point we are in tls mode */ + pThis->pEngine->dbgprint((char*)"relpTcpConnectTLSInit: TLS Mode\n"); + ++ /* set before relpTcpSetSslConfCmd_ossl: tlsConfigCmd may contain ++ * flag-restricted commands that require SSL_CONF_FLAG_CLIENT */ ++ pThis->sslState = osslClient; ++ ++ /* SSL_CONF_cmd targets the SSL_CTX; SSL_new() snapshots the SSL_CTX's ++ * group list at construction time, so this must run before SSL_new() ++ * or the SSL object keeps the default groups set by SSL_CTX_new() */ ++ CHKRet(relpTcpSetSslConfCmd_ossl(pThis, pThis->tlsConfigCmd)); ++ + if(!(pThis->ssl = SSL_new(ctx))) { + relpTcpLastSSLErrorMsg(0, pThis, "relpTcpConnectTLSInit"); + ABORT_FINALIZE(RELP_RET_IO_ERR); +@@ -1894,17 +1903,11 @@ + } else + pThis->authmode = eRelpAuthMode_None; + +- /* Set TLS Options if configured */ +- CHKRet(relpTcpSetSslConfCmd_ossl(pThis, pThis->tlsConfigCmd)); +- + /* Set TLS Priority Options */ + CHKRet(relpTcpTLSSetPrio(pThis)); + + SSL_set_ex_data(pThis->ssl, 0, (void*)pThis); + +- /*set client state */ +- pThis->sslState = osslClient; +- + /* Create BIO from ptcp socket! */ + conn = BIO_new_socket(pThis->sock, BIO_NOCLOSE); + pThis->pEngine->dbgprint((char*)"relpTcpConnectTLSInit: Init conn BIO[%p] done\n", (void *)conn); diff --git a/librelp.spec b/librelp.spec index 6b5f0f6..ad686d0 100644 --- a/librelp.spec +++ b/librelp.spec @@ -1,13 +1,14 @@ Summary: The Reliable Event Logging Protocol library Name: librelp Version: 1.11.0 -Release: 8%{?dist} +Release: 9%{?dist} License: GPL-3.0-or-later URL: http://www.rsyslog.com/ Source0: http://download.rsyslog.com/%{name}/%{name}-%{version}.tar.gz Patch0: disable-openssl-engine.patch Patch1: fix-openssl-fd-double-close.patch +Patch2: fix-ossl-ssl-new-ordering.patch %description Librelp is an easy to use library for the RELP protocol. RELP (stands @@ -35,6 +36,7 @@ to develop applications using librelp. %patch -P 0 -p1 %patch -P 1 -p1 +%patch -P 2 -p1 %build autoreconf -ivf @@ -59,9 +61,14 @@ rm $RPM_BUILD_ROOT/%{_libdir}/*.la %{_libdir}/pkgconfig/relp.pc %changelog +* Thu Jul 09 2026 Attila Lakatos - 1.11.0-9 +- Backport: fix SSL_CONF_cmd/SSL_new ordering in OpenSSL client connect path + Resolves: RHEL-188813 + * Thu Jul 09 2026 Attila Lakatos - 1.11.0-8 - Backport: fix OpenSSL fd double-close in TLS teardown Resolves: RHEL-191751 + * Tue Oct 29 2024 Troy Dawson - 1.11.0-7 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 @@ -204,22 +211,22 @@ rm $RPM_BUILD_ROOT/%{_libdir}/*.la * Wed Nov 21 2012 Tomas Heinrich - 1.0.1-1 - upgrade to upstream version 1.0.1 -* Thu Jul 19 2012 Fedora Release Engineering - 1.0.0-4 +* Thu Jul 19 2012 Fedora Release Engineering - 1.0.0-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild -* Fri Jan 13 2012 Fedora Release Engineering - 1.0.0-3 +* Fri Jan 13 2012 Fedora Release Engineering - 1.0.0-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild -* Tue Feb 08 2011 Fedora Release Engineering - 1.0.0-2 +* Tue Feb 08 2011 Fedora Release Engineering - 1.0.0-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild * Thu Jul 15 2010 Tomas Heinrich - 1.0.0-1 - upgrade to upstream version 1.0.0 -* Sat Jul 25 2009 Fedora Release Engineering - 0.1.1-4 +* Sat Jul 25 2009 Fedora Release Engineering - 0.1.1-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild -* Wed Feb 25 2009 Fedora Release Engineering - 0.1.1-3 +* Wed Feb 25 2009 Fedora Release Engineering - 0.1.1-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild * Wed May 7 2008 Tomas Heinrich 0.1.1-2