mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2025-08-05 22:56:57 +02:00
Code Issues Projects Releases Wiki Activity

MINOR: ssl: relax the 'ssl.default-dh-param' keyword parsing

Browse Source 
Some libraries are ignoring SSL_CTX_set_tmp_dh_callback(), but disabling
the 'ssl.default-dh-param' keyword when the function is not supported would
result in an error instead of silently continuing. This patch emits a
warning when the keyword is not supported instead of a loading failure.
This commit is contained in:
William Lallemand 2024-06-14 11:23:44 +02:00
parent ee5aa4e5e6
commit 7e80af04ca
1 changed files with 9 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/cfgparse-ssl.c
View File

@ -563,6 +563,8 @@ static int ssl_parse_global_dh_param_file(char **args, int section_type, struct
return 0;
}
#endif
/* parse "ssl.default-dh-param".
* Returns <0 on alert, >0 on warning, 0 on success.
*/
@ -570,6 +572,8 @@ static int ssl_parse_global_default_dh(char **args, int section_type, struct pro
const struct proxy *defpx, const char *file, int line,
char **err)
{
#ifndef OPENSSL_NO_DH
if (too_many_args(1, args, err, NULL))
return -1;
@ -584,9 +588,13 @@ static int ssl_parse_global_default_dh(char **args, int section_type, struct pro
return -1;
}
return 0;
}
#else
memprintf(err, "'%s' is not supported by %s, keyword ignored", args[0], OpenSSL_version(OPENSSL_VERSION));
return ERR_WARN;
#endif
}
/*
* parse "ssl-load-extra-files".
@ -2308,9 +2316,7 @@ static struct cfg_kw_list cfg_kws = {ILH, {
{ CFG_GLOBAL, "ssl-security-level", ssl_parse_security_level },
{ CFG_GLOBAL, "ssl-skip-self-issued-ca", ssl_parse_skip_self_issued_ca },
{ CFG_GLOBAL, "tune.ssl.cachesize", ssl_parse_global_int },
#ifndef OPENSSL_NO_DH
{ CFG_GLOBAL, "tune.ssl.default-dh-param", ssl_parse_global_default_dh },
#endif
{ CFG_GLOBAL, "tune.ssl.force-private-cache", ssl_parse_global_private_cache },
{ CFG_GLOBAL, "tune.ssl.lifetime", ssl_parse_global_lifetime },
{ CFG_GLOBAL, "tune.ssl.maxrecord", ssl_parse_global_int },