rpms/librelp
7
0
Fork 0
Code Issues Pull Requests Releases Activity

backport: fix SSL_CONF_cmd/SSL_new ordering in OpenSSL client connect path

Browse Source 
relpTcpConnectTLSInit_ossl() called SSL_new() before applying
tls.tlscfgcmd via relpTcpSetSslConfCmd_ossl(), so the SSL object
inherited the default group list from SSL_CTX instead of the
administrator-configured one.  Move sslState = osslClient and
relpTcpSetSslConfCmd_ossl() to before SSL_new() so the SSL object
snapshots the correctly configured SSL_CTX.

Backport: 9bf89ca142

Resolves: RHEL-192631
Signed-off-by: Cropi <alakatos@redhat.com>
This commit is contained in:
Cropi 2026-07-09 13:27:02 +02:00
parent 5f55fd53ee
commit d2886fda66
2 changed files with 72 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

58
RHEL-192631-fix-ossl-ssl-new-ordering.patch Normal file
View File

@ -0,0 +1,58 @@
From 9bf89ca142bc89d5bf29fc9a437187dd0bffaaa9 Mon Sep 17 00:00:00 2001
From: Cropi <alakatos@redhat.com>
Date: Wed, 24 Jun 2026 13:07:05 +0200
Subject: [PATCH] tcp: fix SSL_CONF_cmd/SSL_new ordering in OpenSSL client
connect path
relpTcpConnectTLSInit_ossl() called SSL_new(ctx) before
relpTcpSetSslConfCmd_ossl(), so SSL_CONF_cmd("Groups", ...) applied via
tls.tlscfgcmd was updating the SSL_CTX after the SSL object had already
captured its group list. On OpenSSL 3.x this caused the client to
advertise the full default group set (including X25519MLKEM768 on 3.5+)
regardless of any Groups restriction in tlsConfigCmd.
Move pThis->sslState = osslClient and relpTcpSetSslConfCmd_ossl() to
before SSL_new() so the SSL object inherits the correctly configured
SSL_CTX. relpTcpTLSSetPrio() stays after SSL_new() because it operates
on pThis->ssl via SSL_set_cipher_list().
Adapted from upstream commit 9bf89ca for librelp-1.10.0 line numbers
(post-downstream-patch context differs from 1.12.0).
Signed-off-by: Cropi <alakatos@redhat.com>
--- a/src/tcp.c
+++ b/src/tcp.c
@@ -1790,6 +1790,15 @@
/*if we reach this point we are in tls mode */
pThis->pEngine->dbgprint((char*)"relpTcpConnectTLSInit: TLS Mode\n");
+ /* set before relpTcpSetSslConfCmd_ossl: tlsConfigCmd may contain
+ * flag-restricted commands that require SSL_CONF_FLAG_CLIENT */
+ pThis->sslState = osslClient;
+
+ /* SSL_CONF_cmd targets the SSL_CTX; SSL_new() snapshots the SSL_CTX's
+ * group list at construction time, so this must run before SSL_new()
+ * or the SSL object keeps the default groups set by SSL_CTX_new() */
+ CHKRet(relpTcpSetSslConfCmd_ossl(pThis, pThis->tlsConfigCmd));
+
if(!(pThis->ssl = SSL_new(ctx))) {
relpTcpLastSSLErrorMsg(0, pThis, "relpTcpConnectTLSInit");
ABORT_FINALIZE(RELP_RET_IO_ERR);
@@ -1805,17 +1814,11 @@
} else
pThis->authmode = eRelpAuthMode_None;
- /* Set TLS Options if configured */
- CHKRet(relpTcpSetSslConfCmd_ossl(pThis, pThis->tlsConfigCmd));
-
/* Set TLS Priority Options */
CHKRet(relpTcpTLSSetPrio(pThis));
SSL_set_ex_data(pThis->ssl, 0, (void*)pThis);
- /*set client state */
- pThis->sslState = osslClient;
-
/* Create BIO from ptcp socket! */
conn = BIO_new_socket(pThis->sock, BIO_NOCLOSE);
pThis->pEngine->dbgprint((char*)"relpTcpConnectTLSInit: Init conn BIO[%p] done\n", (void *)conn);

19
librelp.spec
View File

@ -1,7 +1,7 @@
Summary: The Reliable Event Logging Protocol library
Name: librelp
Version: 1.10.0
Release: 6%{?dist}
Release: 7%{?dist}
License: GPLv3+
URL: http://www.rsyslog.com/
Source0: http://download.rsyslog.com/%{name}/%{name}-%{version}.tar.gz
@ -11,6 +11,10 @@ Patch0: librelp-1.10.0-rhbz1972067-relpEngineSetTLSLibByName.patch
Patch1: librelp-1.10.0-crypto-compliance.patch
Patch2: fix-openssl-fd-double-close.patch
# https://github.com/rsyslog/librelp/commit/9bf89ca142bc89d5bf29fc9a437187dd0bffaaa9
# Resolves: RHEL-192631
Patch3: RHEL-192631-fix-ossl-ssl-new-ordering.patch
%description
Librelp is an easy to use library for the RELP protocol. RELP (stands
for Reliable Event Logging Protocol) is a general-purpose, extensible
@ -34,9 +38,10 @@ to develop applications using librelp.
%prep
%setup -q
%patch0 -p1 -b .tls-by-name
%patch1 -p1 -b .crypto-compliance
%patch2 -p1
%patch -P 0 -p1 -b .tls-by-name
%patch -P 1 -p1 -b .crypto-compliance
%patch -P 2 -p1
%patch -P 3 -p1
%build
autoreconf -ivf
@ -61,7 +66,11 @@ rm $RPM_BUILD_ROOT/%{_libdir}/*.la
%{_libdir}/pkgconfig/relp.pc
%changelog
* Wed Jul 09 2026 Attila Lakatos <alakatos@redhat.com> - 1.10.0-6
* Thu Jul 09 2026 Attila Lakatos <alakatos@redhat.com> - 1.10.0-7
- Backport: fix SSL_CONF_cmd/SSL_new ordering in OpenSSL client connect path
Resolves: RHEL-192631
* Thu Jul 09 2026 Attila Lakatos <alakatos@redhat.com> - 1.10.0-6
- Backport: fix OpenSSL fd double-close in TLS teardown
Resolves: RHEL-192630