From 051b9f05a120bf4b4048767b2e84b0d40a8bc6b2 Mon Sep 17 00:00:00 2001 From: Howard Chu Date: Tue, 14 May 2024 16:13:15 +0100 Subject: [PATCH] ITS#10216 libldap: fix OpenSSL channel binding digest The OBJ_find_ API is undocumented but this is what OpenSSL libcrypto does itself. --- libraries/libldap/tls_o.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/libraries/libldap/tls_o.c b/libraries/libldap/tls_o.c index d5861d9339..2e0806315a 100644 --- a/libraries/libldap/tls_o.c +++ b/libraries/libldap/tls_o.c @@ -54,8 +54,10 @@ #if OPENSSL_VERSION_MAJOR >= 3 #define ERR_get_error_line( a, b ) ERR_get_error_all( a, b, NULL, NULL, NULL ) +#ifndef SSL_get_peer_certificate #define SSL_get_peer_certificate( s ) SSL_get1_peer_certificate( s ) #endif +#endif typedef SSL_CTX tlso_ctx; typedef SSL tlso_session; @@ -1068,7 +1070,12 @@ tlso_session_endpoint( tls_session *sess, struct berval *buf, int is_server ) return 0; #if OPENSSL_VERSION_NUMBER >= 0x10100000 - md = EVP_get_digestbynid( X509_get_signature_nid( cert )); + { + int mdnid; + if ( !OBJ_find_sigid_algs( X509_get_signature_nid( cert ), &mdnid, NULL )) + return 0; + md = EVP_get_digestbynid( mdnid ); + } #else md = EVP_get_digestbynid(OBJ_obj2nid( cert->sig_alg->algorithm )); #endif -- 2.47.3