mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2025-08-07 15:47:01 +02:00
Code Issues Projects Releases Wiki Activity

CLEANUP: ssl: remove SSL_CTX function parameter

Browse Source 
Since the server SSL_CTX is now stored in the ckch_inst, it is not
needed anymore to pass an SSL_CTX to ckch_inst_new_load_srv_store() and
ssl_sock_load_srv_ckchs().
This commit is contained in:
William Lallemand 2021-01-26 11:27:42 +01:00
parent 1dedb0a82a
commit 795bd9ba3a
3 changed files with 9 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
include/haproxy/ssl_ckch.h
View File

@ -50,7 +50,7 @@ struct ckch_inst *ckch_inst_new();
int ckch_inst_new_load_store(const char *path, struct ckch_store *ckchs, struct bind_conf *bind_conf, int ckch_inst_new_load_store(const char *path, struct ckch_store *ckchs, struct bind_conf *bind_conf,
struct ssl_bind_conf *ssl_conf, char **sni_filter, int fcount, struct ckch_inst **ckchi, char **err); struct ssl_bind_conf *ssl_conf, char **sni_filter, int fcount, struct ckch_inst **ckchi, char **err);
int ckch_inst_new_load_srv_store(const char *path, struct ckch_store *ckchs, int ckch_inst_new_load_srv_store(const char *path, struct ckch_store *ckchs,
struct ckch_inst **ckchi, SSL_CTX **ssl_ctx, char **err); struct ckch_inst **ckchi, char **err);
void ckch_deinit(); void ckch_deinit();

7
src/ssl_ckch.c
View File

@ -1317,7 +1317,6 @@ static int cli_io_handler_commit_cert(struct appctx *appctx)
struct ckch_inst *new_inst; struct ckch_inst *new_inst;
char **sni_filter = NULL; char **sni_filter = NULL;
int fcount = 0; int fcount = 0;
SSL_CTX *ctx = NULL;
/* it takes a lot of CPU to creates SSL_CTXs, so we yield every 10 CKCH instances */ /* it takes a lot of CPU to creates SSL_CTXs, so we yield every 10 CKCH instances */
if (y >= 10) { if (y >= 10) {
@ -1332,7 +1331,7 @@ static int cli_io_handler_commit_cert(struct appctx *appctx)
} }
if (ckchi->is_server_instance) if (ckchi->is_server_instance)
errcode |= ckch_inst_new_load_srv_store(new_ckchs->path, new_ckchs, &new_inst, &ctx, &err); errcode |= ckch_inst_new_load_srv_store(new_ckchs->path, new_ckchs, &new_inst, &err);
else else
errcode |= ckch_inst_new_load_store(new_ckchs->path, new_ckchs, ckchi->bind_conf, ckchi->ssl_conf, sni_filter, fcount, &new_inst, &err); errcode |= ckch_inst_new_load_store(new_ckchs->path, new_ckchs, ckchi->bind_conf, ckchi->ssl_conf, sni_filter, fcount, &new_inst, &err);
@ -1347,11 +1346,9 @@ static int cli_io_handler_commit_cert(struct appctx *appctx)
new_inst->server = ckchi->server; new_inst->server = ckchi->server;
/* Create a new SSL_CTX and link it to the new instance. */ /* Create a new SSL_CTX and link it to the new instance. */
if (new_inst->is_server_instance) { if (new_inst->is_server_instance) {
errcode |= ssl_sock_prepare_srv_ssl_ctx(ckchi->server, ctx); errcode |= ssl_sock_prepare_srv_ssl_ctx(ckchi->server, new_inst->ctx);
if (errcode & ERR_CODE) if (errcode & ERR_CODE)
goto error; goto error;
new_inst->ctx = ctx;
} }
/* create the link to the crtlist_entry */ /* create the link to the crtlist_entry */

20
src/ssl_sock.c
View File

@ -3454,7 +3454,7 @@ int ckch_inst_new_load_store(const char *path, struct ckch_store *ckchs, struct
* ERR_WARN if a warning is available into err * ERR_WARN if a warning is available into err
*/ */
int ckch_inst_new_load_srv_store(const char *path, struct ckch_store *ckchs, int ckch_inst_new_load_srv_store(const char *path, struct ckch_store *ckchs,
struct ckch_inst **ckchi, SSL_CTX **ssl_ctx, char **err) struct ckch_inst **ckchi, char **err)
{ {
SSL_CTX *ctx; SSL_CTX *ctx;
struct cert_key_and_chain *ckch; struct cert_key_and_chain *ckch;
@ -3476,10 +3476,6 @@ int ckch_inst_new_load_srv_store(const char *path, struct ckch_store *ckchs,
goto error; goto error;
} }
if (*ssl_ctx)
SSL_CTX_free(*ssl_ctx);
*ssl_ctx = ctx;
errcode |= ssl_sock_put_srv_ckch_into_ctx(path, ckch, ctx, err); errcode |= ssl_sock_put_srv_ckch_into_ctx(path, ckch, ctx, err);
if (errcode & ERR_CODE) if (errcode & ERR_CODE)
goto error; goto error;
@ -3492,14 +3488,11 @@ int ckch_inst_new_load_srv_store(const char *path, struct ckch_store *ckchs,
goto error; goto error;
} }
SSL_CTX_up_ref(ctx);
/* everything succeed, the ckch instance can be used */ /* everything succeed, the ckch instance can be used */
ckch_inst->bind_conf = NULL; ckch_inst->bind_conf = NULL;
ckch_inst->ssl_conf = NULL; ckch_inst->ssl_conf = NULL;
ckch_inst->ckch_store = ckchs; ckch_inst->ckch_store = ckchs;
ckch_inst->ctx = ctx;
SSL_CTX_free(ctx); /* we need to free the ctx since we incremented the refcount where it's used */
*ckchi = ckch_inst; *ckchi = ckch_inst;
return errcode; return errcode;
@ -3536,13 +3529,12 @@ static int ssl_sock_load_ckchs(const char *path, struct ckch_store *ckchs,
} }
static int ssl_sock_load_srv_ckchs(const char *path, struct ckch_store *ckchs, static int ssl_sock_load_srv_ckchs(const char *path, struct ckch_store *ckchs,
struct ckch_inst **ckch_inst, struct ckch_inst **ckch_inst, char **err)
SSL_CTX **ssl_ctx, char **err)
{ {
int errcode = 0; int errcode = 0;
/* we found the ckchs in the tree, we can use it directly */ /* we found the ckchs in the tree, we can use it directly */
errcode |= ckch_inst_new_load_srv_store(path, ckchs, ckch_inst, ssl_ctx, err); errcode |= ckch_inst_new_load_srv_store(path, ckchs, ckch_inst, err);
if (errcode & ERR_CODE) if (errcode & ERR_CODE)
return errcode; return errcode;
@ -3751,7 +3743,7 @@ int ssl_sock_load_srv_cert(char *path, struct server *server, char **err)
if ((ckchs = ckchs_lookup(path))) { if ((ckchs = ckchs_lookup(path))) {
/* we found the ckchs in the tree, we can use it directly */ /* we found the ckchs in the tree, we can use it directly */
cfgerr |= ssl_sock_load_srv_ckchs(path, ckchs, &server->ssl_ctx.inst, &server->ssl_ctx.ctx, err); cfgerr |= ssl_sock_load_srv_ckchs(path, ckchs, &server->ssl_ctx.inst, err);
found++; found++;
} else if (stat(path, &buf) == 0) { } else if (stat(path, &buf) == 0) {
/* We do not manage directories on backend side. */ /* We do not manage directories on backend side. */
@ -3760,7 +3752,7 @@ int ssl_sock_load_srv_cert(char *path, struct server *server, char **err)
ckchs = ckchs_load_cert_file(path, err); ckchs = ckchs_load_cert_file(path, err);
if (!ckchs) if (!ckchs)
cfgerr |= ERR_ALERT | ERR_FATAL; cfgerr |= ERR_ALERT | ERR_FATAL;
cfgerr |= ssl_sock_load_srv_ckchs(path, ckchs, &server->ssl_ctx.inst, &server->ssl_ctx.ctx, err); cfgerr |= ssl_sock_load_srv_ckchs(path, ckchs, &server->ssl_ctx.inst, err);
if (server->ssl_ctx.inst) { if (server->ssl_ctx.inst) {
server->ssl_ctx.inst->is_server_instance = 1; server->ssl_ctx.inst->is_server_instance = 1;
server->ssl_ctx.inst->server = server; server->ssl_ctx.inst->server = server;