BUG/MINOR: ssl: don't uppercase the native group name

The change to SSL_get0_group_name() assumed that its output differed
from SSL_get_negotiated_group() followed by OBJ_nid2sn() only in
case. This is true for x25519/X25519 and x448/X448, but cannot be
generalized to other groups.

For P-256, the APIs return secp256r1 and prime256v1 respectively:
these are aliases, not a case difference. For P-384 and P-521, both
APIs already return secp384r1 and secp521r1, so uppercasing actually
introduces a mismatch. It also changes native mixed-case hybrid names
such as SecP256r1MLKEM768.

Moreover, SSL_get0_group_name() returns a library-owned string shared
through the SSL_CTX. Uppercasing it in place modifies OpenSSL state
and risks concurrent access to that string.

Remove the uppercase conversion and return the native name unchanged.

This should not be backported as it would could break matching of the
curves.

diff --git a/reg-tests/ssl/ssl_curve_name.vtci b/reg-tests/ssl/ssl_curve_name.vtci
index c71fb2fc8e6a34c473ed6d93f1581dcdf0663fb5..7808cf1dfe887c5438e82315f9d5f6196d353e2b 100644 (file)
--- a/reg-tests/ssl/ssl_curve_name.vtci
+++ b/reg-tests/ssl/ssl_curve_name.vtci
@@ -50,8 +50,8 @@ client c1 -connect ${h1_clearlst_sock} {
     txreq
     rxresp
     expect resp.status == 200
-    expect resp.http.x-ssl-fc-curve-name == "X25519"
-    expect resp.http.x-ssl-bc-curve-name == "X25519"
+    expect resp.http.x-ssl-fc-curve-name ~ "^[Xx]25519$"
+    expect resp.http.x-ssl-bc-curve-name ~ "^[Xx]25519$"
 
 } -run
 

diff --git a/reg-tests/ssl/ssl_curves_selection.vtci b/reg-tests/ssl/ssl_curves_selection.vtci
index 07e8f6357f1215c23f1e6d8585beabd1f3f5c4df..0cd9d909f4927fa24f3078ba2922af37cdb5a466 100644 (file)
--- a/reg-tests/ssl/ssl_curves_selection.vtci
+++ b/reg-tests/ssl/ssl_curves_selection.vtci
@@ -89,24 +89,25 @@ haproxy h1 -conf {
 } -start
 
 
+# P-256 names differ between the native group-name and NID-based APIs.
 client c1 -connect ${h1_clearlst_sock} {
     txreq -url "/X25519"
     rxresp
-    expect resp.http.x-curve == X25519
+    expect resp.http.x-curve ~ "^[Xx]25519$"
     expect resp.status == 200
 } -run
 
 client c1 -connect ${h1_clearlst_sock} {
     txreq -url "/P-256"
     rxresp
-    expect resp.http.x-curve ~ (SECP256R1|prime256v1)
+    expect resp.http.x-curve ~ "^(secp256r1|prime256v1)$"
     expect resp.status == 200
 } -run
 
 client c1 -connect ${h1_clearlst_sock} {
     txreq -url "/P-384"
     rxresp
-    expect resp.http.x-curve ~ (SECP384R1|secp384r1)
+    expect resp.http.x-curve == secp384r1
     expect resp.status == 200
 } -run
 
@@ -122,7 +123,7 @@ client c2 -connect ${h1_clearlst_sock} -repeat 2 {
 client c3 -connect ${h1_clearlst_sock} {
     txreq -url "/wrong-be1"
     rxresp
-    expect resp.http.x-curve == X25519
+    expect resp.http.x-curve ~ "^[Xx]25519$"
     expect resp.status == 200
 } -run
 
@@ -137,7 +138,7 @@ client c2 -connect ${h1_clearlst_sock} -repeat 2 {
 client c3 -connect ${h1_clearlst_sock} {
     txreq -url "/wrong-be1"
     rxresp
-    expect resp.http.x-curve ~ (SECP384R1|secp384r1)
+    expect resp.http.x-curve == secp384r1
     expect resp.status == 200
 } -run
 

diff --git a/src/ssl_sample.c b/src/ssl_sample.c
index baa6449ecf1261eb80d5fef61708b128e2efa5a7..ef5e6344cae27c0822ad375b98564cc3c5020b64 100644 (file)
--- a/src/ssl_sample.c
+++ b/src/ssl_sample.c
@@ -1756,21 +1756,8 @@ smp_fetch_ssl_fc_ec(const struct arg *args, struct sample *smp, const char *kw,
         */
 # if (HA_OPENSSL_VERSION_NUMBER >= 0x3020000fL)
        curve_name = (char *)SSL_get0_group_name(ssl);
-       if (curve_name == NULL) {
+       if (curve_name == NULL)
                return 0;
-       } else {
-               /*
-                * The curve name returned by SSL_get0_group_name is in lowercase whereas the curve
-                * name returned when we use `SSL_get_negotiated_group` and `OBJ_nid2sn` is the
-                * short name and is in upper case. To make the return value consistent across the
-                * different functional calls and to make it consistent while upgrading OpenSSL versions,
-                * will convert the curve name returned by SSL_get0_group_name to upper case.
-                */
-               int i;
-
-               for (i = 0; curve_name[i]; i++)
-                       curve_name[i] = toupper((unsigned char)curve_name[i]);
-       }
 # elif defined(OPENSSL_IS_AWSLC) && AWSLC_API_VERSION < 35
        group = SSL_get_group_id(ssl);