mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2025-11-22 19:31:02 +01:00
Code Issues Projects Releases Wiki Activity

BUG/MINOR: ssl: ssl-skip-self-issued-ca requires >= 1.0.2

Browse Source 
The previous fix for ssl-skip-self-issued-ca requires the use of
SSL_CTX_build_cert_chain() which is only available starting from OpenSSL
1.0.2
This commit is contained in:
William Lallemand 2020-08-10 17:28:23 +02:00 committed by William Lallemand
parent bf298afe2d
commit 9a1d839f61
3 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
doc/configuration.txt
View File

@ -1426,7 +1426,7 @@ ssl-skip-self-issued-ca
issuer for ocsp without the need for '.issuer' file and be able to share it issuer for ocsp without the need for '.issuer' file and be able to share it
with 'issuers-chain-path'. This concerns all certificates without intermediate with 'issuers-chain-path'. This concerns all certificates without intermediate
certificates. It's useless for BoringSSL, .issuer is ignored because ocsp certificates. It's useless for BoringSSL, .issuer is ignored because ocsp
bits does not need it. bits does not need it. Requires at least OpenSSL 1.0.2.
stats socket [<address:port>|<path>] [param*] stats socket [<address:port>|<path>] [param*]
Binds a UNIX socket to <path> or a TCPv4/v6 address to <address:port>. Binds a UNIX socket to <path> or a TCPv4/v6 address to <address:port>.

5
src/cfgparse-ssl.c
View File

@ -1698,8 +1698,13 @@ static int ssl_parse_skip_self_issued_ca(char **args, int section_type, struct p
struct proxy *defpx, const char *file, int line, struct proxy *defpx, const char *file, int line,
char **err) char **err)
{ {
#ifdef SSL_CTX_build_cert_chain
global_ssl.skip_self_issued_ca = 1; global_ssl.skip_self_issued_ca = 1;
return 0; return 0;
#else
memprintf(err, "global statement '%s' requires at least OpenSSL 1.0.2.", args[0]);
return -1;
#endif
} }

2
src/ssl_sock.c
View File

@ -3011,6 +3011,7 @@ static int ssl_sock_put_ckch_into_ctx(const char *path, const struct cert_key_an
} }
#endif #endif
#ifdef SSL_CTX_build_cert_chain
/* remove the Root CA from the SSL_CTX if the option is activated */ /* remove the Root CA from the SSL_CTX if the option is activated */
if (global_ssl.skip_self_issued_ca) { if (global_ssl.skip_self_issued_ca) {
if (!SSL_CTX_build_cert_chain(ctx, SSL_BUILD_CHAIN_FLAG_NO_ROOT|SSL_BUILD_CHAIN_FLAG_UNTRUSTED|SSL_BUILD_CHAIN_FLAG_IGNORE_ERROR)) { if (!SSL_CTX_build_cert_chain(ctx, SSL_BUILD_CHAIN_FLAG_NO_ROOT|SSL_BUILD_CHAIN_FLAG_UNTRUSTED|SSL_BUILD_CHAIN_FLAG_IGNORE_ERROR)) {
@ -3020,6 +3021,7 @@ static int ssl_sock_put_ckch_into_ctx(const char *path, const struct cert_key_an
goto end; goto end;
} }
} }
#endif
#ifndef OPENSSL_NO_DH #ifndef OPENSSL_NO_DH
/* store a NULL pointer to indicate we have not yet loaded /* store a NULL pointer to indicate we have not yet loaded