From b6b803991449d213b0314676c47d9d0f91b8306d Mon Sep 17 00:00:00 2001
From: "Roger A. Light" <roger@atchoo.org>
Date: Tue, 17 May 2022 17:18:21 +0100
Subject: [PATCH] Fix use of `MOSQ_OPT_TLS_ENGINE` being unable to be used.

This was due to the openssl ctx not being initialised until starting to connect.

Closes #2537. Thanks to chessing-c4.
---
 ChangeLog.txt       |  2 ++
 include/mosquitto.h |  3 +++
 lib/options.c       | 19 +++++++++++--------
 3 files changed, 16 insertions(+), 8 deletions(-)

diff --git a/ChangeLog.txt b/ChangeLog.txt
index dd81c5359e..e1bb6e102c 100644
--- a/ChangeLog.txt
+++ b/ChangeLog.txt
@@ -11,6 +11,8 @@ Broker:
 Client library:
 - Fix threads library detection on Windows under cmake. Bumps the minimum
   cmake version to 3.1, which is still ancient.
+- Fix use of `MOSQ_OPT_TLS_ENGINE` being unable to be used due to the openssl
+  ctx not being initialised until starting to connect. Closes #2537.
 
 Clients:
 - Fix mosquitto_pub incorrectly reusing topic aliases when reconnecting.
diff --git a/include/mosquitto.h b/include/mosquitto.h
index e514d3f6cb..8fc43a9584 100644
--- a/include/mosquitto.h
+++ b/include/mosquitto.h
@@ -1565,6 +1565,9 @@ libmosq_EXPORT int mosquitto_int_option(struct mosquitto *mosq, enum mosq_opt_t
  *	MOSQ_OPT_TLS_ENGINE - Configure the client for TLS Engine support.
  *	          Pass a TLS Engine ID to be used when creating TLS
  *	          connections. Must be set before <mosquitto_connect>.
+ *	          Must be a valid engine, and note that the string will not be used
+ *	          until a connection attempt is made so this function will return
+ *	          success even if an invalid engine string is passed.
  *
  *	MOSQ_OPT_TLS_KEYFORM - Configure the client to treat the keyfile
  *	          differently depending on its type.  Must be set
diff --git a/lib/options.c b/lib/options.c
index 29f8225f20..fa7386c264 100644
--- a/lib/options.c
+++ b/lib/options.c
@@ -284,14 +284,17 @@ int mosquitto_string_option(struct mosquitto *mosq, enum mosq_opt_t option, cons
 	switch(option){
 		case MOSQ_OPT_TLS_ENGINE:
 #if defined(WITH_TLS) && !defined(OPENSSL_NO_ENGINE)
-			eng = ENGINE_by_id(value);
-			if(!eng){
-				return MOSQ_ERR_INVAL;
-			}
-			ENGINE_free(eng); /* release the structural reference from ENGINE_by_id() */
-			mosq->tls_engine = mosquitto__strdup(value);
-			if(!mosq->tls_engine){
-				return MOSQ_ERR_NOMEM;
+			mosquitto__free(mosq->tls_engine);
+			if(value){
+				eng = ENGINE_by_id(value);
+				if(!eng){
+					return MOSQ_ERR_INVAL;
+				}
+				ENGINE_free(eng); /* release the structural reference from ENGINE_by_id() */
+				mosq->tls_engine = mosquitto__strdup(value);
+				if(!mosq->tls_engine){
+					return MOSQ_ERR_NOMEM;
+				}
 			}
 			return MOSQ_ERR_SUCCESS;
 #else