From 3d42d560dde61899ce83f541e59245b9bbbe07dd Mon Sep 17 00:00:00 2001 From: Josiah VanderZee Date: Sat, 1 Aug 2026 12:33:01 -0500 Subject: [PATCH 1/3] Remove OpenSSL ENGINE code Commit a966bc4cce (#11219) accidentally disabled OpenSSL ENGINE support entirely. Although it was unintentional, it seems clear no one is using that API by this point (no one has reported it was broken), and the API is gone in recent OpenSSL versions. This patch removes the dead logic. --- CMakeLists.txt | 3 --- src/iocore/net/SSLUtils.cc | 21 --------------------- 2 files changed, 24 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index e926d8a8995..66a24bba3f2 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -631,9 +631,6 @@ check_symbol_exists(SSL_get_all_async_fds openssl/ssl.h TS_USE_TLS_ASYNC) check_symbol_exists(OSSL_PARAM_construct_end "openssl/params.h" HAVE_OSSL_PARAM_CONSTRUCT_END) check_symbol_exists(TLS1_3_VERSION "openssl/ssl.h" TS_USE_TLS13) check_symbol_exists(MD5_Init "openssl/md5.h" HAVE_MD5_INIT) -check_symbol_exists(ENGINE_load_dynamic "openssl/engine.h" HAVE_ENGINE_LOAD_DYNAMIC) -check_symbol_exists(ENGINE_get_default_RSA "openssl/engine.h" HAVE_ENGINE_GET_DEFAULT_RSA) -check_symbol_exists(ENGINE_load_private_key "openssl/engine.h" HAVE_ENGINE_LOAD_PRIVATE_KEY) check_symbol_exists(sysctlbyname "sys/sysctl.h" HAVE_SYSCTLBYNAME) if(SSLLIB_IS_OPENSSL3) diff --git a/src/iocore/net/SSLUtils.cc b/src/iocore/net/SSLUtils.cc index 6e766d69922..fd0fc3f7f86 100644 --- a/src/iocore/net/SSLUtils.cc +++ b/src/iocore/net/SSLUtils.cc @@ -60,9 +60,6 @@ #endif #include #include -#if HAVE_ENGINE_LOAD_DYNAMIC -#include -#endif #include #include #include @@ -770,10 +767,6 @@ void SSLPostConfigInitialize() { if (SSLConfigParams::engine_conf_file) { -#if HAVE_ENGINE_LOAD_DYNAMIC - ENGINE_load_dynamic(); -#endif - OPENSSL_load_builtin_modules(); if (CONF_modules_load_file(SSLConfigParams::engine_conf_file, nullptr, 0) <= 0) { char err_buf[256] = {0}; @@ -859,20 +852,6 @@ SSLPrivateKeyHandler(SSL_CTX *ctx, const char *keyPath, const char *secret_data, // SSL_CTX_use_PrivateKey() takes its own reference on the key, so this // reference must be released on every exit. scoped_PKEY pkey; -#if HAVE_ENGINE_GET_DEFAULT_RSA && HAVE_ENGINE_LOAD_PRIVATE_KEY - ENGINE *e = ENGINE_get_default_RSA(); - if (e != nullptr) { - pkey.reset(ENGINE_load_private_key(e, keyPath, nullptr, nullptr)); - if (pkey) { - if (!SSL_CTX_use_PrivateKey(ctx, pkey.get())) { - Dbg(dbg_ctl_ssl_load, "failed to load server private key from engine"); - return false; - } - } - } -#else - void *e = nullptr; -#endif if (pkey == nullptr) { scoped_BIO bio(BIO_new_mem_buf(secret_data, secret_data_len)); From 0332e75fb19f6b05c5527f1bd902576fc434af69 Mon Sep 17 00:00:00 2001 From: Josiah VanderZee Date: Sat, 1 Aug 2026 13:18:48 -0500 Subject: [PATCH 2/3] Remove access to removed local --- src/iocore/net/SSLUtils.cc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/iocore/net/SSLUtils.cc b/src/iocore/net/SSLUtils.cc index fd0fc3f7f86..3854baecbdf 100644 --- a/src/iocore/net/SSLUtils.cc +++ b/src/iocore/net/SSLUtils.cc @@ -869,7 +869,7 @@ SSLPrivateKeyHandler(SSL_CTX *ctx, const char *keyPath, const char *secret_data, (!keyPath || keyPath[0] == '\0') ? "[empty key path]" : keyPath); return false; } - if (e == nullptr && !SSL_CTX_check_private_key(ctx)) { + if (!SSL_CTX_check_private_key(ctx)) { Dbg(dbg_ctl_ssl_load, "server private key does not match the certificate public key"); return false; } From cb9985dd4825724bef3ad825c0242fa2fc889bcf Mon Sep 17 00:00:00 2001 From: Josiah VanderZee Date: Sat, 1 Aug 2026 13:33:19 -0500 Subject: [PATCH 3/3] Cleanup logic structure --- src/iocore/net/SSLUtils.cc | 37 +++++++++++++++++-------------------- 1 file changed, 17 insertions(+), 20 deletions(-) diff --git a/src/iocore/net/SSLUtils.cc b/src/iocore/net/SSLUtils.cc index 3854baecbdf..ef8be284f9c 100644 --- a/src/iocore/net/SSLUtils.cc +++ b/src/iocore/net/SSLUtils.cc @@ -851,28 +851,25 @@ SSLPrivateKeyHandler(SSL_CTX *ctx, const char *keyPath, const char *secret_data, { // SSL_CTX_use_PrivateKey() takes its own reference on the key, so this // reference must be released on every exit. - scoped_PKEY pkey; - if (pkey == nullptr) { - scoped_BIO bio(BIO_new_mem_buf(secret_data, secret_data_len)); + scoped_BIO bio(BIO_new_mem_buf(secret_data, secret_data_len)); - pem_password_cb *password_cb = SSL_CTX_get_default_passwd_cb(ctx); - void *u = SSL_CTX_get_default_passwd_cb_userdata(ctx); + pem_password_cb *password_cb = SSL_CTX_get_default_passwd_cb(ctx); + void *u = SSL_CTX_get_default_passwd_cb_userdata(ctx); - pkey.reset(PEM_read_bio_PrivateKey(bio.get(), nullptr, password_cb, u)); - if (nullptr == pkey) { - Dbg(dbg_ctl_ssl_load, "failed to load server private key (%.*s) from %s", secret_data_len < 50 ? secret_data_len : 50, - secret_data, (!keyPath || keyPath[0] == '\0') ? "[empty key path]" : keyPath); - return false; - } - if (!SSL_CTX_use_PrivateKey(ctx, pkey.get())) { - Dbg(dbg_ctl_ssl_load, "failed to attach server private key loaded from %s", - (!keyPath || keyPath[0] == '\0') ? "[empty key path]" : keyPath); - return false; - } - if (!SSL_CTX_check_private_key(ctx)) { - Dbg(dbg_ctl_ssl_load, "server private key does not match the certificate public key"); - return false; - } + scoped_PKEY const pkey{PEM_read_bio_PrivateKey(bio.get(), nullptr, password_cb, u)}; + if (nullptr == pkey) { + Dbg(dbg_ctl_ssl_load, "failed to load server private key (%.*s) from %s", secret_data_len < 50 ? secret_data_len : 50, + secret_data, (!keyPath || keyPath[0] == '\0') ? "[empty key path]" : keyPath); + return false; + } + if (!SSL_CTX_use_PrivateKey(ctx, pkey.get())) { + Dbg(dbg_ctl_ssl_load, "failed to attach server private key loaded from %s", + (!keyPath || keyPath[0] == '\0') ? "[empty key path]" : keyPath); + return false; + } + if (!SSL_CTX_check_private_key(ctx)) { + Dbg(dbg_ctl_ssl_load, "server private key does not match the certificate public key"); + return false; } return true;