BUG/MINOR: ssl: skip the cipher workaround with AWS-LC API 38 and newer

The crt-list cipher workaround reparses the ciphers and ciphersuites
strings on each connection after SSL_set_SSL_CTX(). AWS-LC restored
context-based cipher inheritance in 5.14.0, so these calls are redundant
with a library providing the fixed context-switching behavior.

Limit the workaround to AWSLC_API_VERSION values greater than 30 and
below 38. Keep the string setters for older API versions and preserve
the API 30 exclusion, where cipher lists already follow the SSL_CTX.
This deliberately retains the workaround for API 37, including 5.14.0,
since that API version also identifies earlier, affected releases.

This follows 38398d2476 ("BUG/MEDIUM: ssl: crt-list ciphers ignored with
AWS-LC") and relates to GitHub issue #3500 and aws/aws-lc#3614.

This should be backported as far as 3.0. The code is in src/ssl_sock.c
before 3.1.

diff --git a/src/ssl_clienthello.c b/src/ssl_clienthello.c
index c2a749a129dcf3c2ab1d45540df8185e67875c16..43c7a42823b18bfb7cb579ce212f8113001bae2b 100644 (file)
--- a/src/ssl_clienthello.c
+++ b/src/ssl_clienthello.c
@@ -465,13 +465,14 @@ sni_lookup:
                        methodVersions[conf->ssl_methods.max].ssl_set_version(ssl, SET_MAX);
                        if (conf->early_data)
                                allow_early = 1;
-#if defined(OPENSSL_IS_AWSLC) && AWSLC_API_VERSION > 30
+#if defined(OPENSSL_IS_AWSLC) && (AWSLC_API_VERSION > 30) && (AWSLC_API_VERSION < 38)
                        /* AWS-LC copies the cipher lists at SSL_new() time and does
                         * not update them on SSL_set_SSL_CTX(). Reapply the crt-list
                         * options. API version 30 (AWS-LC 3.x) uses the SSL_CTX
                         * cipher lists directly and does not need this workaround.
                         * These calls are inefficient as they parse the cipher
                         * configuration strings for each connection.
+                        * SSL_set_SSL_CTX() was fixed in AWS-LC 5.14.0
                         */
                        if ((conf->ciphers && !SSL_set_cipher_list(ssl, conf->ciphers)) ||
                            (conf->ciphersuites && !SSL_set_ciphersuites(ssl, conf->ciphersuites))) {