OpenSSL: Apply connection flags before reading certificates

This is needed to be able to drop the OpenSSL security level, if
necessary, for cases where old certificates (e.g., something using SHA-1
signatures) are still needed. openssl_ciphers="DEFAULT@SECLEVEL=0" can
achieve this, but only if applied before attempting to load the
certificates.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>

diff --git a/src/crypto/tls_openssl.c b/src/crypto/tls_openssl.c
index bb916c5c08ccc17c33c7cba6ab272745d3e423d7..7b90e7681baafa1395d05cc2416af42436ecb694 100644 (file)
--- a/src/crypto/tls_openssl.c
+++ b/src/crypto/tls_openssl.c
@@ -5377,6 +5377,10 @@ int tls_connection_set_params(void *tls_ctx, struct tls_connection *conn,
                           __func__, ERR_error_string(err, NULL));
        }
 
+       if (tls_set_conn_flags(conn, params->flags,
+                              params->openssl_ciphers) < 0)
+               return -1;
+
        if (engine_id) {
                wpa_printf(MSG_DEBUG, "SSL: Initializing TLS engine %s",
                           engine_id);
@@ -5475,10 +5479,6 @@ int tls_connection_set_params(void *tls_ctx, struct tls_connection *conn,
 #endif /* OPENSSL_IS_BORINGSSL */
        }
 
-       if (tls_set_conn_flags(conn, params->flags,
-                              params->openssl_ciphers) < 0)
-               return -1;
-
 #ifdef OPENSSL_IS_BORINGSSL
        if (params->flags & TLS_CONN_REQUEST_OCSP) {
                SSL_enable_ocsp_stapling(conn->ssl);