From 5d769ca828fdb055052b3dbc232864bdf2853c9f Mon Sep 17 00:00:00 2001 From: Remi Gacogne Date: Thu, 28 May 2015 16:23:00 +0200 Subject: [PATCH 12/14] BUG/MEDIUM: ssl: fix tune.ssl.default-dh-param value being overwritten MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Hervé Commowick reported that the logic used to avoid complaining about ssl-default-dh-param not being set when static DH params are present in the certificate file was clearly wrong when more than one sni_ctx is used. This patch stores whether static DH params are being used for each SSL_CTX individually, and does not overwrite the value of tune.ssl.default-dh-param. (cherry picked from commit 4f902b88323927c9d25d391a809e3678ac31df41) --- src/ssl_sock.c | 28 +++++++++++++++++++++++----- 1 file changed, 23 insertions(+), 5 deletions(-) diff --git a/src/ssl_sock.c b/src/ssl_sock.c index a78fc6a..0f7819b 100644 --- a/src/ssl_sock.c +++ b/src/ssl_sock.c @@ -47,6 +47,9 @@ #ifdef SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB #include #endif +#ifndef OPENSSL_NO_DH +#include +#endif #include #include @@ -107,6 +110,7 @@ int sslconns = 0; int totalsslconns = 0; #ifndef OPENSSL_NO_DH +static int ssl_dh_ptr_index = -1; static DH *local_dh_1024 = NULL; static DH *local_dh_2048 = NULL; static DH *local_dh_4096 = NULL; @@ -1076,10 +1080,12 @@ int ssl_sock_load_dh_params(SSL_CTX *ctx, const char *file) if (dh) { ret = 1; SSL_CTX_set_tmp_dh(ctx, dh); - /* Setting ssl default dh param to the size of the static DH params - found in the file. This way we know that there is no use - complaining later about ssl-default-dh-param not being set. */ - global.tune.ssl_default_dh_param = DH_size(dh) * 8; + + if (ssl_dh_ptr_index >= 0) { + /* store a pointer to the DH params to avoid complaining about + ssl-default-dh-param not being set for this SSL_CTX */ + SSL_CTX_set_ex_data(ctx, ssl_dh_ptr_index, dh); + } } else { /* Clear openssl global errors stack */ @@ -1274,6 +1280,12 @@ static int ssl_sock_load_cert_file(const char *path, struct bind_conf *bind_conf * the tree, so it will be discovered and cleaned in time. */ #ifndef OPENSSL_NO_DH + /* store a NULL pointer to indicate we have not yet loaded + a custom DH param file */ + if (ssl_dh_ptr_index >= 0) { + SSL_CTX_set_ex_data(ctx, ssl_dh_ptr_index, NULL); + } + ret = ssl_sock_load_dh_params(ctx, path); if (ret < 0) { if (err) @@ -1593,7 +1605,9 @@ int ssl_sock_prepare_ctx(struct bind_conf *bind_conf, SSL_CTX *ctx, struct proxy /* If tune.ssl.default-dh-param has not been set and no static DH params were in the certificate file. */ - if (global.tune.ssl_default_dh_param == 0) { + if (global.tune.ssl_default_dh_param == 0 && + (ssl_dh_ptr_index == -1 || + SSL_CTX_get_ex_data(ctx, ssl_dh_ptr_index) == NULL)) { ciphers = ctx->cipher_list; if (ciphers) { @@ -4715,6 +4729,10 @@ static void __ssl_sock_init(void) bind_register_keywords(&bind_kws); srv_register_keywords(&srv_kws); cfg_register_keywords(&cfg_kws); + +#ifndef OPENSSL_NO_DH + ssl_dh_ptr_index = SSL_CTX_get_ex_new_index(0, NULL, NULL, NULL, NULL); +#endif } __attribute__((destructor)) -- 2.0.5