From: William Lallemand <wlallemand@haproxy.com>
Date: Thu, 12 Nov 2026 12:30:08 +0000 (+0000)
Subject: BUG/MINOR: ssl: skip the cipher workaround with AWS-LC API 38 and newer
X-Git-Tag: v3.5-dev12~36
X-Git-Url: https://git.kaiwu.me/%7B@url%7D?a=commitdiff_plain;h=6334b928631c08b8009de078b6eeff1dfc1583e3;p=haproxy.git

BUG/MINOR: ssl: skip the cipher workaround with AWS-LC API 38 and newer

The crt-list cipher workaround reparses the ciphers and ciphersuites
strings on each connection after SSL_set_SSL_CTX(). AWS-LC restored
context-based cipher inheritance in 5.14.0, so these calls are redundant
with a library providing the fixed context-switching behavior.

Limit the workaround to AWSLC_API_VERSION values greater than 30 and
below 38. Keep the string setters for older API versions and preserve
the API 30 exclusion, where cipher lists already follow the SSL_CTX.
This deliberately retains the workaround for API 37, including 5.14.0,
since that API version also identifies earlier, affected releases.

This follows 38398d2476 ("BUG/MEDIUM: ssl: crt-list ciphers ignored with
AWS-LC") and relates to GitHub issue #3500 and aws/aws-lc#3614.

This should be backported as far as 3.0. The code is in src/ssl_sock.c
before 3.1.
---

diff --git a/src/ssl_clienthello.c b/src/ssl_clienthello.c
index c2a749a12..43c7a4282 100644
--- a/src/ssl_clienthello.c
+++ b/src/ssl_clienthello.c
@@ -465,13 +465,14 @@ sni_lookup:
 			methodVersions[conf->ssl_methods.max].ssl_set_version(ssl, SET_MAX);
 			if (conf->early_data)
 				allow_early = 1;
-#if defined(OPENSSL_IS_AWSLC) && AWSLC_API_VERSION > 30
+#if defined(OPENSSL_IS_AWSLC) && (AWSLC_API_VERSION > 30) && (AWSLC_API_VERSION < 38)
 			/* AWS-LC copies the cipher lists at SSL_new() time and does
 			 * not update them on SSL_set_SSL_CTX(). Reapply the crt-list
 			 * options. API version 30 (AWS-LC 3.x) uses the SSL_CTX
 			 * cipher lists directly and does not need this workaround.
 			 * These calls are inefficient as they parse the cipher
 			 * configuration strings for each connection.
+			 * SSL_set_SSL_CTX() was fixed in AWS-LC 5.14.0
 			 */
 			if ((conf->ciphers && !SSL_set_cipher_list(ssl, conf->ciphers)) ||
 			    (conf->ciphersuites && !SSL_set_ciphersuites(ssl, conf->ciphersuites))) {