mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2025-08-06 15:17:01 +02:00
Code Issues Projects Releases Wiki Activity

MINOR: ssl: Certificate chain loading refactorization

Browse Source 
Move the certificate chain loading code into a dedicated function that
will then be useable elsewhere.
This commit is contained in:
Remi Tricot-Le Breton 2021-01-25 17:19:42 +01:00 committed by William Lallemand
parent 442b7f2238
commit ec805a32b9
1 changed files with 43 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

57
src/ssl_sock.c
View File

@ -3093,7 +3093,8 @@ static int ssl_sock_load_dh_params(SSL_CTX *ctx, const struct cert_key_and_chain
} }
#endif #endif
/* Loads the info in ckch into ctx
/* Load a certificate chain into an SSL context.
* Returns a bitfield containing the flags: * Returns a bitfield containing the flags:
* ERR_FATAL in any fatal error case * ERR_FATAL in any fatal error case
* ERR_ALERT if the reason of the error is available in err * ERR_ALERT if the reason of the error is available in err
@ -3101,16 +3102,14 @@ static int ssl_sock_load_dh_params(SSL_CTX *ctx, const struct cert_key_and_chain
* The value 0 means there is no error nor warning and * The value 0 means there is no error nor warning and
* the operation succeed. * the operation succeed.
*/ */
static int ssl_sock_put_ckch_into_ctx(const char *path, const struct cert_key_and_chain *ckch, SSL_CTX *ctx, char **err) static int ssl_sock_load_cert_chain(const char *path, const struct cert_key_and_chain *ckch,
SSL_CTX *ctx, STACK_OF(X509) **find_chain, char **err)
{ {
int errcode = 0; int errcode = 0;
STACK_OF(X509) *find_chain = NULL;
if (SSL_CTX_use_PrivateKey(ctx, ckch->key) <= 0) { if (find_chain == NULL) {
memprintf(err, "%sunable to load SSL private key into SSL Context '%s'.\n", errcode |= ERR_FATAL;
err && *err ? *err : "", path); goto end;
errcode |= ERR_ALERT | ERR_FATAL;
return errcode;
} }
if (!SSL_CTX_use_certificate(ctx, ckch->cert)) { if (!SSL_CTX_use_certificate(ctx, ckch->cert)) {
@ -3121,24 +3120,24 @@ static int ssl_sock_put_ckch_into_ctx(const char *path, const struct cert_key_an
} }
if (ckch->chain) { if (ckch->chain) {
find_chain = ckch->chain; *find_chain = ckch->chain;
} else { } else {
/* Find Certificate Chain in global */ /* Find Certificate Chain in global */
struct issuer_chain *issuer; struct issuer_chain *issuer;
issuer = ssl_get0_issuer_chain(ckch->cert); issuer = ssl_get0_issuer_chain(ckch->cert);
if (issuer) if (issuer)
find_chain = issuer->chain; *find_chain = issuer->chain;
} }
if (!find_chain) { if (!*find_chain) {
/* always put a null chain stack in the SSL_CTX so it does not /* always put a null chain stack in the SSL_CTX so it does not
* try to build the chain from the verify store */ * try to build the chain from the verify store */
find_chain = sk_X509_new_null(); *find_chain = sk_X509_new_null();
} }
/* Load all certs in the ckch into the ctx_chain for the ssl_ctx */ /* Load all certs in the ckch into the ctx_chain for the ssl_ctx */
#ifdef SSL_CTX_set1_chain #ifdef SSL_CTX_set1_chain
if (!SSL_CTX_set1_chain(ctx, find_chain)) { if (!SSL_CTX_set1_chain(ctx, *find_chain)) {
memprintf(err, "%sunable to load chain certificate into SSL Context '%s'. Make sure you are linking against Openssl >= 1.0.2.\n", memprintf(err, "%sunable to load chain certificate into SSL Context '%s'. Make sure you are linking against Openssl >= 1.0.2.\n",
err && *err ? *err : "", path); err && *err ? *err : "", path);
errcode |= ERR_ALERT | ERR_FATAL; errcode |= ERR_ALERT | ERR_FATAL;
@ -3148,7 +3147,7 @@ static int ssl_sock_put_ckch_into_ctx(const char *path, const struct cert_key_an
{ /* legacy compat (< openssl 1.0.2) */ { /* legacy compat (< openssl 1.0.2) */
X509 *ca; X509 *ca;
STACK_OF(X509) *chain; STACK_OF(X509) *chain;
chain = X509_chain_up_ref(find_chain); chain = X509_chain_up_ref(*find_chain);
while ((ca = sk_X509_shift(chain))) while ((ca = sk_X509_shift(chain)))
if (!SSL_CTX_add_extra_chain_cert(ctx, ca)) { if (!SSL_CTX_add_extra_chain_cert(ctx, ca)) {
memprintf(err, "%sunable to load chain certificate into SSL Context '%s'.\n", memprintf(err, "%sunable to load chain certificate into SSL Context '%s'.\n",
@ -3173,6 +3172,36 @@ static int ssl_sock_put_ckch_into_ctx(const char *path, const struct cert_key_an
} }
#endif #endif
end:
return errcode;
}
/* Loads the info in ckch into ctx
* Returns a bitfield containing the flags:
* ERR_FATAL in any fatal error case
* ERR_ALERT if the reason of the error is available in err
* ERR_WARN if a warning is available into err
* The value 0 means there is no error nor warning and
* the operation succeed.
*/
static int ssl_sock_put_ckch_into_ctx(const char *path, const struct cert_key_and_chain *ckch, SSL_CTX *ctx, char **err)
{
int errcode = 0;
STACK_OF(X509) *find_chain = NULL;
if (SSL_CTX_use_PrivateKey(ctx, ckch->key) <= 0) {
memprintf(err, "%sunable to load SSL private key into SSL Context '%s'.\n",
err && *err ? *err : "", path);
errcode |= ERR_ALERT | ERR_FATAL;
return errcode;
}
/* Load certificate chain */
errcode |= ssl_sock_load_cert_chain(path, ckch, ctx, &find_chain, err);
if (errcode & ERR_CODE)
goto end;
#ifndef OPENSSL_NO_DH #ifndef OPENSSL_NO_DH
/* store a NULL pointer to indicate we have not yet loaded /* store a NULL pointer to indicate we have not yet loaded
a custom DH param file */ a custom DH param file */