luo980/curl
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

mbedtls: call mbedtls_ssl_setup() after RNG callback is set

Browse Source 
Since mbedTLS v3.6.0, the RNG check added in ssl_conf_check() will fail
if no RNG is provided when calling mbedtls_ssl_setup().

Therefore, mbedtls_ssl_conf_rng() needs to be called before the SSL
context is passed to mbedtls_ssl_setup().

Ref: b422cab052

Signed-off-by: Kailun Qin <kailun.qin@intel.com>
Closes #13314
This commit is contained in:
Kailun Qin 2024-04-08 05:13:56 -04:00 committed by Daniel Stenberg
parent 50def7c881
commit b679efc0bb
No known key found for this signature in database
GPG Key ID: 5CC908FDB71E12C2
1 changed files with 9 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
lib/vtls/mbedtls.c
View File

@ -602,10 +602,6 @@ mbed_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
}
mbedtls_ssl_init(&backend->ssl);
if(mbedtls_ssl_setup(&backend->ssl, &backend->config)) {
failf(data, "mbedTLS: ssl_init failed");
return CURLE_SSL_CONNECT_ERROR;
}
/* new profile with RSA min key len = 1024 ... */
mbedtls_ssl_conf_cert_profile(&backend->config,
@ -639,6 +635,15 @@ mbed_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
mbedtls_ssl_conf_rng(&backend->config, mbedtls_ctr_drbg_random,
&backend->ctr_drbg);
ret = mbedtls_ssl_setup(&backend->ssl, &backend->config);
if(ret) {
mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
failf(data, "ssl_setup failed - mbedTLS: (-0x%04X) %s",
-ret, errorbuf);
return CURLE_SSL_CONNECT_ERROR;
}
mbedtls_ssl_set_bio(&backend->ssl, cf,
mbedtls_bio_cf_write,
mbedtls_bio_cf_read,