relpTcpConnectTLSInit_ossl() called SSL_new() before applying
tls.tlscfgcmd via relpTcpSetSslConfCmd_ossl(), so the SSL object
inherited the default group list from SSL_CTX instead of the
administrator-configured one. Move sslState = osslClient and
relpTcpSetSslConfCmd_ossl() to before SSL_new() so the SSL object
snapshots the correctly configured SSL_CTX.
Backport: 9bf89ca142
Resolves: RHEL-192631
Signed-off-by: Cropi <alakatos@redhat.com>
Backport https://github.com/rsyslog/librelp/pull/292
Move relpTcpDestructTLS() before the socket close so SSL_shutdown()
can send the close_notify on a valid fd. Change BIO_new_socket()
from BIO_CLOSE to BIO_NOCLOSE so SSL_free() does not close the fd
a second time via the BIO destructor. Add conn = NULL after
SSL_set_bio() to prevent the error-path use-after-free.
Resolves: RHEL-192630
Signed-off-by: Cropi <alakatos@redhat.com>
Replace GNUTLS_SHUT_RDWR by GNUTLS_SHUT_WR when ending TLS connections
resolves: rhbz#1990735
Comply with rhel crypto policies
Forward return code from relpEngineSetTLSLib to relpEngineSetTLSLibByName
resolves: rhbz#1972067
