mirror of
https://github.com/OpenVPN/openvpn.git
synced 2025-05-07 20:55:53 +08:00
aab1f862f4
Additional context from PR on Github about changes in ssl_openssl.c around line 1900: This change addresses a subtle behavioral difference between AWS-LC and OpenSSL regarding object ownership semantics in SSL_CTX_set_client_CA_list(ctx->ctx, cert_names). OpenSSL Behavior: Stores a reference to the provided cert_names stack cert_names remains valid after SSL_CTX_set_client_CA_list AWS-LC Behavior: Creates a copy of the parameter cert_names (which is a stack of type X509_NAME) and converts it to a stack of CRYPTO_BUFFER (how we internally represent X509_NAME, it's an opaque byte string). Then frees the original passed in cert_names. After SSL_CTX_set_client_CA_list, cert_names no longer points to valid memory. The proposed changes reorder operations to getting the size of the stack before the set operation as opposed to after the set operation. No operations between the setter and stack size check modify cert_names. Therefore, the logical outcome should remain the same - and this would also handle the subtle behavioral difference in AWS-LC. Github: closes OpenVPN/openvpn#672 Signed-off-by: Shubham Mittal <smittals@amazon.com> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20250128220932.2113-1-smittals@amazon.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg30682.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
19 lines
789 B
Plaintext
19 lines
789 B
Plaintext
This version of OpenVPN supports AWS-LC (AWS Libcrypto), AWS's open-source cryptographic library.
|
|
|
|
If you encounter bugs in OpenVPN while using AWS-LC:
|
|
1. Try compiling OpenVPN with OpenSSL to determine if the issue is specific to AWS-LC
|
|
2. For AWS-LC-specific issues, please report them at: https://github.com/aws/aws-lc
|
|
|
|
To build and install OpenVPN with AWS-LC:
|
|
|
|
OPENSSL_CFLAGS="-I/${AWS_LC_INSTALL_FOLDER}/include" \
|
|
OPENSSL_LIBS="-L/${AWS_LC_INSTALL_FOLDER}/lib -lssl -lcrypto" \
|
|
LDFLAGS="-Wl,-rpath=${AWS_LC_INSTALL_FOLDER}/lib" \
|
|
./configure --with-crypto-library=openssl
|
|
make
|
|
make install
|
|
|
|
*************************************************************************
|
|
Due to limitations in AWS-LC, the following features are missing
|
|
* Windows CryptoAPI support
|