[rpms/openssl] rebase_40beta: upstream fix for status request extension non-compliance (#1737471)

[rpms/openssl] rebase_40beta: upstream fix for status request extension non-compliance (#1737471)

[Tomas Mraz]

A new commit has been pushed.

Repo   : rpms/openssl
Branch : rebase_40beta
Commit : 45ebb7fdc228d3984726ecbf5656880386df8550
Author : Tomas Mraz <tmraz@fedoraproject.org>
Date   : 2019-09-06T17:02:18+02:00
Stats  : +39/-0 in 2 file(s)
URL    : https://src.fedoraproject.org/rpms/openssl/c/45ebb7fdc228d3984726ecbf5656880386df8550?branch=rebase_40beta

Log:
upstream fix for status request extension non-compliance (#1737471)

---
diff --git a/openssl-1.1.1-status-request.patch b/openssl-1.1.1-status-request.patch
new file mode 100644
index 0000000..3f92cd5
--- /dev/null
+++ b/openssl-1.1.1-status-request.patch
@@ -0,0 +1,36 @@
+From 93e26cedac20844733d59f33e313880da17fa23a Mon Sep 17 00:00:00 2001
+From: Matt Caswell <matt@openssl.org>
+Date: Thu, 5 Sep 2019 16:43:57 +0100
+Subject: [PATCH 1/2] Don't send a status_request extension in a
+ CertificateRequest message
+
+If a TLSv1.3 server configured to respond to the status_request extension
+also attempted to send a CertificateRequest then it was incorrectly
+inserting a non zero length status_request extension into that message.
+
+The TLSv1.3 RFC does allow that extension in that message but it must
+always be zero length.
+
+In fact we should not be sending the extension at all in that message
+because we don't support it.
+
+Fixes #9767
+---
+ ssl/statem/extensions_srvr.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/ssl/statem/extensions_srvr.c b/ssl/statem/extensions_srvr.c
+index e16722cbeb8..1c023fc6c40 100644
+--- a/ssl/statem/extensions_srvr.c
++++ b/ssl/statem/extensions_srvr.c
+@@ -1491,6 +1491,10 @@ EXT_RETURN tls_construct_stoc_status_request(SSL *s, WPACKET *pkt,
+                                              unsigned int context, X509 *x,
+                                              size_t chainidx)
+ {
++    /* We don't currently support this extension inside a CertificateRequest */
++    if (context == SSL_EXT_TLS1_3_CERTIFICATE_REQUEST)
++        return EXT_RETURN_NOT_SENT;
++
+     if (!s->ext.status_expected)
+         return EXT_RETURN_NOT_SENT;
+ 

diff --git a/openssl.spec b/openssl.spec
index fbd2b87..19af11a 100644
--- a/openssl.spec
+++ b/openssl.spec
@@ -454,6 +454,9 @@ export LD_LIBRARY_PATH
 %ldconfig_scriptlets libs
 
 %changelog
+* Fri Sep  6 2019 Tomáš Mráz <tmraz@redhat.com> 1.1.1c-6
+- upstream fix for status request extension non-compliance (#1737471)
+
 * Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1:1.1.1c-5
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild