mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2025-08-08 08:07:10 +02:00
Code Issues Projects Releases Wiki Activity

BUG/MINOR; ssl: Don't assume we have a ssl_bind_conf because a SNI is matched.

Browse Source 
We only have a ssl_bind_conf if crt-list is used, however we can still
match a certificate SNI, so don't assume we have a ssl_bind_conf.
This commit is contained in:
Olivier Houchard 2017-11-02 19:04:38 +01:00 committed by Willy Tarreau
parent 9e45b33f7e
commit 35a63cc1c7
1 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/ssl_sock.c
View File

@ -2267,11 +2267,13 @@ static int ssl_sock_switchctx_cbk(SSL *ssl, int *al, void *arg)
/* switch ctx */ /* switch ctx */
struct ssl_bind_conf *conf = container_of(node, struct sni_ctx, name)->conf; struct ssl_bind_conf *conf = container_of(node, struct sni_ctx, name)->conf;
ssl_sock_switchctx_set(ssl, container_of(node, struct sni_ctx, name)->ctx); ssl_sock_switchctx_set(ssl, container_of(node, struct sni_ctx, name)->ctx);
methodVersions[conf->ssl_methods.min].ssl_set_version(ssl, SET_MIN); if (conf) {
methodVersions[conf->ssl_methods.max].ssl_set_version(ssl, SET_MAX); methodVersions[conf->ssl_methods.min].ssl_set_version(ssl, SET_MIN);
if (conf->early_data) methodVersions[conf->ssl_methods.max].ssl_set_version(ssl, SET_MAX);
allow_early = 1; if (conf->early_data)
goto allow_early; allow_early = 1;
}
goto allow_early;
} }
#if (!defined SSL_NO_GENERATE_CERTIFICATES) #if (!defined SSL_NO_GENERATE_CERTIFICATES)
if (s->generate_certs && ssl_sock_generate_certificate(trash.str, s, ssl)) { if (s->generate_certs && ssl_sock_generate_certificate(trash.str, s, ssl)) {