From 9c79756c47801e50fdbf7b07b7e6ea1dfad2779b Mon Sep 17 00:00:00 2001 From: tb <> Date: Wed, 24 May 2023 09:15:14 +0000 Subject: Copy the verify param hostflags independently of the host list Without this, hostflags set on the SSL_CTX would not propagate to newly created SSL. This is surprising behavior that was changed in OpenSSL 1.1 by Christian Heimes after the issue was flagged by Quentin Pradet: https://bugs.python.org/issue43522 This is a version of the fix that landed in OpenSSL. There used to be a workaround in place in urllib3, but that was removed at some point. We haven't fixed this earlier since it wasn't reported. It only showed up after recent fallout of extraordinarily strict library checking in urllib3 coming from their own interpretation of the implications of PEP 644. ok jsing --- src/lib/libcrypto/x509/x509_vpm.c | 7 ++++--- src/regress/lib/libssl/unit/Makefile | 4 +--- 2 files changed, 5 insertions(+), 6 deletions(-) diff --git a/src/lib/libcrypto/x509/x509_vpm.c b/src/lib/libcrypto/x509/x509_vpm.c index 2110787a5f..5c8c09e9fc 100644 --- a/src/lib/libcrypto/x509/x509_vpm.c +++ b/src/lib/libcrypto/x509/x509_vpm.c @@ -1,4 +1,4 @@ -/* $OpenBSD: x509_vpm.c,v 1.38 2023/05/24 08:46:01 tb Exp $ */ +/* $OpenBSD: x509_vpm.c,v 1.39 2023/05/24 09:15:14 tb Exp $ */ /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL * project 2004. */ @@ -326,7 +326,9 @@ X509_VERIFY_PARAM_inherit(X509_VERIFY_PARAM *dest, const X509_VERIFY_PARAM *src) return 0; } - /* Copy the host flags if and only if we're copying the host list */ + if (test_x509_verify_param_copy_id(hostflags, 0)) + dest->id->hostflags = id->hostflags; + if (test_x509_verify_param_copy_id(hosts, NULL)) { if (dest->id->hosts) { sk_OPENSSL_STRING_pop_free(dest->id->hosts, str_free); @@ -337,7 +339,6 @@ X509_VERIFY_PARAM_inherit(X509_VERIFY_PARAM *dest, const X509_VERIFY_PARAM *src) sk_deep_copy(id->hosts, strdup, str_free); if (dest->id->hosts == NULL) return 0; - dest->id->hostflags = id->hostflags; } } diff --git a/src/regress/lib/libssl/unit/Makefile b/src/regress/lib/libssl/unit/Makefile index 413307b7a0..6a925069ca 100644 --- a/src/regress/lib/libssl/unit/Makefile +++ b/src/regress/lib/libssl/unit/Makefile @@ -1,4 +1,4 @@ -# $OpenBSD: Makefile,v 1.15 2023/05/24 08:54:59 tb Exp $ +# $OpenBSD: Makefile,v 1.16 2023/05/24 09:15:14 tb Exp $ PROGS += cipher_list PROGS += ssl_get_shared_ciphers @@ -18,6 +18,4 @@ CFLAGS+= -I${.CURDIR}/../../../../lib/libssl LDADD_ssl_verify_param = ${LIBSSL} ${CRYPTO_INT} -REGRESS_EXPECTED_FAILURES+= run-regress-ssl_verify_param - .include -- cgit v1.2.3-55-g6feb