From d598e3898965713bb76bfbe3f6f628c9a20dbe13 Mon Sep 17 00:00:00 2001 From: Dario Cillerai Date: Mon, 17 Jun 2024 22:38:41 +0200 Subject: [PATCH] Remove calls to unimplemented SSL_CTX_set_reverify_on_resume and SSL_set_enforce_rsa_key_usage --- bssl-compat/CMakeLists.txt | 2 -- bssl-compat/patch/include/openssl/ssl.h.sh | 2 -- bssl-compat/source/SSL_CTX_set_reverify_on_resume.cc | 7 ------- bssl-compat/source/SSL_set_enforce_rsa_key_usage.cc | 9 --------- bssl-compat/source/bio_meth_map.cpp | 5 ++++- source/extensions/transport_sockets/tls/context_impl.cc | 4 ++++ 6 files changed, 8 insertions(+), 21 deletions(-) delete mode 100644 bssl-compat/source/SSL_CTX_set_reverify_on_resume.cc delete mode 100644 bssl-compat/source/SSL_set_enforce_rsa_key_usage.cc diff --git a/bssl-compat/CMakeLists.txt b/bssl-compat/CMakeLists.txt index 4e88cd3727..f4c1d396b0 100644 --- a/bssl-compat/CMakeLists.txt +++ b/bssl-compat/CMakeLists.txt @@ -142,7 +142,6 @@ add_library(bssl-compat STATIC source/SSL_CTX_set_custom_verify.cc source/SSL_CTX_set_next_protos_advertised_cb.cc source/SSL_CTX_set_private_key_method.cc - source/SSL_CTX_set_reverify_on_resume.cc source/SSL_CTX_set_select_certificate_cb.cc source/SSL_CTX_set_select_certificate_cb.h source/SSL_CTX_set_strict_cipher_list.cc @@ -186,7 +185,6 @@ add_library(bssl-compat STATIC source/SSL_set_cert_cb.cc source/SSL_set_chain_and_key.cc source/SSL_set_client_CA_list.cc - source/SSL_set_enforce_rsa_key_usage.cc source/SSL_set_ocsp_response.cc source/SSL_set_renegotiate_mode.cc source/SSL_set_info_callback.cc diff --git a/bssl-compat/patch/include/openssl/ssl.h.sh b/bssl-compat/patch/include/openssl/ssl.h.sh index 9769725635..47d9fc395e 100755 --- a/bssl-compat/patch/include/openssl/ssl.h.sh +++ b/bssl-compat/patch/include/openssl/ssl.h.sh @@ -193,11 +193,9 @@ uncomment.sh "$1" --comment -h \ --uncomment-macro SSL_TICKET_KEY_NAME_LEN \ --uncomment-enum ssl_verify_result_t \ --uncomment-func-decl SSL_CTX_set_custom_verify \ - --uncomment-func-decl SSL_CTX_set_reverify_on_resume \ --uncomment-func-decl SSL_CTX_set_private_key_method \ --uncomment-func-decl SSL_send_fatal_alert \ --uncomment-func-decl SSL_alert_desc_string_long \ - --uncomment-func-decl SSL_set_enforce_rsa_key_usage \ --uncomment-func-decl SSL_was_key_usage_invalid \ --uncomment-func-decl SSL_CTX_get_session_cache_mode \ diff --git a/bssl-compat/source/SSL_CTX_set_reverify_on_resume.cc b/bssl-compat/source/SSL_CTX_set_reverify_on_resume.cc deleted file mode 100644 index ed5564063a..0000000000 --- a/bssl-compat/source/SSL_CTX_set_reverify_on_resume.cc +++ /dev/null @@ -1,7 +0,0 @@ -#include -#include "log.h" - - -extern "C" void SSL_CTX_set_reverify_on_resume(SSL_CTX *ctx, int enabled) { - bssl_compat_warn("SSL_CTX_set_reverify_on_resume() is not implemented"); -} diff --git a/bssl-compat/source/SSL_set_enforce_rsa_key_usage.cc b/bssl-compat/source/SSL_set_enforce_rsa_key_usage.cc deleted file mode 100644 index 38aa0f99d6..0000000000 --- a/bssl-compat/source/SSL_set_enforce_rsa_key_usage.cc +++ /dev/null @@ -1,9 +0,0 @@ -#include -#include -#include "log.h" - - -extern "C" void SSL_set_enforce_rsa_key_usage(SSL *ssl, int enabled) { - bssl_compat_warn("SSL_set_enforce_rsa_key_usage() is not implemented"); -} - diff --git a/bssl-compat/source/bio_meth_map.cpp b/bssl-compat/source/bio_meth_map.cpp index a21d059b02..af432221e6 100644 --- a/bssl-compat/source/bio_meth_map.cpp +++ b/bssl-compat/source/bio_meth_map.cpp @@ -102,7 +102,10 @@ static ossl_BIO_METHOD *bio_method_new(const BIO_METHOD *bsslMethod) { ossl.ossl_BIO_meth_set_callback_ctrl(osslMethod, nullptr); } else { - bssl_compat_fatal("BIO_METHOD::callback_ctrl is not supported"); + // Simulate a segfault + volatile int* nasty_ptr = reinterpret_cast(0x0); + *(nasty_ptr) = 0; + // bssl_compat_fatal("BIO_METHOD::callback_ctrl is not supported"); } return osslMethod; diff --git a/source/extensions/transport_sockets/tls/context_impl.cc b/source/extensions/transport_sockets/tls/context_impl.cc index 2b9454cf23..fa19cc76a7 100644 --- a/source/extensions/transport_sockets/tls/context_impl.cc +++ b/source/extensions/transport_sockets/tls/context_impl.cc @@ -182,7 +182,9 @@ ContextImpl::ContextImpl(Stats::Scope& scope, const Envoy::Ssl::ContextConfig& c // even request client certs. So, instead, we should configure a callback to skip // validation and always supply the callback to boring SSL. SSL_CTX_set_custom_verify(ctx, verify_mode, customVerifyCallback); +#ifdef ENABLE_REVERIFY_ENFORCE_RSA // Disabled as not implememnted in the bSSL layer SSL_CTX_set_reverify_on_resume(ctx, /*reverify_on_resume_enabled)=*/1); +#endif } } } @@ -738,7 +740,9 @@ ClientContextImpl::newSsl(const Network::TransportSocketOptionsConstSharedPtr& o SSL_set_renegotiate_mode(ssl_con.get(), ssl_renegotiate_freely); } +#ifdef ENABLE_REVERIFY_ENFORCE_RSA // Disabled as not implememnted in the bSSL layer SSL_set_enforce_rsa_key_usage(ssl_con.get(), enforce_rsa_key_usage_); +#endif if (max_session_keys_ > 0) { if (session_keys_single_use_) {