[openssl-commits] [openssl] master update

[Matt Caswell]

The branch master has been updated
       via  8f8be103fd7d8b5992724d618c99cbddd7dd00d7 (commit)
      from  27df4597316c28a03c73bacb4095e86e41da65bb (commit)


- Log -----------------------------------------------------------------
commit 8f8be103fd7d8b5992724d618c99cbddd7dd00d7
Author: Richard Levitte <levitte at openssl.org>
Date:   Mon Mar 19 20:33:50 2018 +0100

    s_client, s_server: do generic SSL configuration first, specialization after
    
    We did the SSL_CONF_cmd() pass last of all things that could affect
    the SSL ctx.  However, the results of this, for example:
    
        -max_protocol TLSv1.3 -tls1_2
    
    ... would mean that the protocol min got set to TLSv1.2 and the
    protocol max to TLSv1.3, when they should clearly both be TLSv1.2.
    
    However, if we see the SSL_CONF_cmd() switches as generic and those
    internal to s_client and s_server as specialisations, we get something
    that makes a little more sense.
    
    Reviewed-by: Tim Hudson <tjh at openssl.org>
    Reviewed-by: Matt Caswell <matt at openssl.org>
    (Merged from https://github.com/openssl/openssl/pull/5679)

-----------------------------------------------------------------------

Summary of changes:
 apps/s_client.c | 12 +++++++-----
 apps/s_server.c | 12 ++++++++----
 2 files changed, 15 insertions(+), 9 deletions(-)

diff --git a/apps/s_client.c b/apps/s_client.c
index 1ed853d..4b7df0c 100644
--- a/apps/s_client.c
+++ b/apps/s_client.c
@@ -1672,6 +1672,9 @@ int s_client_main(int argc, char **argv)
     if (sdebug)
         ssl_ctx_security_debug(ctx, sdebug);
 
+    if (!config_ctx(cctx, ssl_args, ctx))
+        goto end;
+
     if (ssl_config != NULL) {
         if (SSL_CTX_config(ctx, ssl_config) == 0) {
             BIO_printf(bio_err, "Error using configuration \"%s\"\n",
@@ -1681,9 +1684,11 @@ int s_client_main(int argc, char **argv)
         }
     }
 
-    if (SSL_CTX_set_min_proto_version(ctx, min_version) == 0)
+    if (min_version != 0
+        && SSL_CTX_set_min_proto_version(ctx, min_version) == 0)
         goto end;
-    if (SSL_CTX_set_max_proto_version(ctx, max_version) == 0)
+    if (max_version != 0
+        && SSL_CTX_set_max_proto_version(ctx, max_version) == 0)
         goto end;
 
     if (vpmtouched && !SSL_CTX_set1_param(ctx, vpm)) {
@@ -1729,9 +1734,6 @@ int s_client_main(int argc, char **argv)
         goto end;
     }
 
-    if (!config_ctx(cctx, ssl_args, ctx))
-        goto end;
-
     if (!ssl_load_stores(ctx, vfyCApath, vfyCAfile, chCApath, chCAfile,
                          crls, crl_download)) {
         BIO_printf(bio_err, "Error loading store locations\n");
diff --git a/apps/s_server.c b/apps/s_server.c
index d21631e..bfa1345 100644
--- a/apps/s_server.c
+++ b/apps/s_server.c
@@ -1755,6 +1755,10 @@ int s_server_main(int argc, char *argv[])
     }
     if (sdebug)
         ssl_ctx_security_debug(ctx, sdebug);
+
+    if (!config_ctx(cctx, ssl_args, ctx))
+        goto end;
+
     if (ssl_config) {
         if (SSL_CTX_config(ctx, ssl_config) == 0) {
             BIO_printf(bio_err, "Error using configuration \"%s\"\n",
@@ -1763,9 +1767,11 @@ int s_server_main(int argc, char *argv[])
             goto end;
         }
     }
-    if (SSL_CTX_set_min_proto_version(ctx, min_version) == 0)
+    if (min_version != 0
+        && SSL_CTX_set_min_proto_version(ctx, min_version) == 0)
         goto end;
-    if (SSL_CTX_set_max_proto_version(ctx, max_version) == 0)
+    if (max_version != 0
+        && SSL_CTX_set_max_proto_version(ctx, max_version) == 0)
         goto end;
 
     if (session_id_prefix) {
@@ -1841,8 +1847,6 @@ int s_server_main(int argc, char *argv[])
     }
 
     ssl_ctx_add_crls(ctx, crls, 0);
-    if (!config_ctx(cctx, ssl_args, ctx))
-        goto end;
 
     if (!ssl_load_stores(ctx, vfyCApath, vfyCAfile, chCApath, chCAfile,
                          crls, crl_download)) {