TLS context handling code: Fix an abort on ancient OpenSSL version

There was a logical bug when setting a list of enabled TLS protocols,
which may lead to a crash (an abort()) on systems with ancient OpenSSL
versions.

The problem was due to the fact that we were INSIST()ing on supporting
all of the TLS versions, while checking only for mentioned in the
configuration was implied.

diff --git a/lib/isc/tls.c b/lib/isc/tls.c
index a59bb4f2adc1283cf96af2fd76e752cb6c68f04d..d59e90ded6c9ab02e392c8e2fbfa80e5770d6dcf 100644 (file)
--- a/lib/isc/tls.c
+++ b/lib/isc/tls.c
@@ -453,14 +453,18 @@ isc_tlsctx_set_protocols(isc_tlsctx_t *ctx, const uint32_t tls_versions) {
        for (uint32_t tls_ver = ISC_TLS_PROTO_VER_1_2;
             tls_ver < ISC_TLS_PROTO_VER_UNDEFINED; tls_ver <<= 1)
        {
-               /* Only supported versions should ever be passed to the
-                * function. The configuration file was not verified
-                * properly, if we are trying to enable an unsupported
-                * TLS version */
-               INSIST(isc_tls_protocol_supported(tls_ver));
                if ((tls_versions & tls_ver) == 0) {
                        set_options |= get_tls_version_disable_bit(tls_ver);
                } else {
+                       /*
+                        * Only supported versions should ever be passed to the
+                        * function SSL_CTX_clear_options. For example, in order
+                        * to enable TLS v1.2, we have to clear
+                        * SSL_OP_NO_TLSv1_2. Insist that the configuration file
+                        * was verified properly, so we are not trying to enable
+                        * an unsupported TLS version.
+                        */
+                       INSIST(isc_tls_protocol_supported(tls_ver));
                        clear_options |= get_tls_version_disable_bit(tls_ver);
                }
                versions &= ~(tls_ver);