BUG/MINOR: ssl: abort on sni allocation failure
The ssl_sock_add_cert_sni() function never return an error when a
sni_ctx allocation fail. It silently ignores the problem and continues
to try to allocate other snis.
It is unlikely that a sni allocation will succeed after one failure and
start a configuration without all the snis. But to avoid any problem we
return a -1 upon an sni allocation error and stop the configuration
parsing.
This patch must be backported in every version supporting the crt-list
sni filters. (as far as 1.5)
(cherry picked from commit fe49bb3d0c046628d67d57da15a7034cc2230432)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
[Cf: slightly adapted for 2.0]
diff --git a/src/ssl_sock.c b/src/ssl_sock.c
index 97a1b78..06d6737 100644
--- a/src/ssl_sock.c
+++ b/src/ssl_sock.c
@@ -2814,7 +2814,7 @@
for (j = 0; j < len && j < trash.size; j++)
trash.area[j] = tolower(name[j]);
if (j >= trash.size)
- return order;
+ return -1;
trash.area[j] = 0;
/* Check for duplicates. */
@@ -2830,7 +2830,7 @@
sc = malloc(sizeof(struct sni_ctx) + len + 1);
if (!sc)
- return order;
+ return -1;
memcpy(sc->name.key, trash.area, len + 1);
sc->ctx = ctx;
sc->conf = conf;
@@ -3270,7 +3270,12 @@
/* Update SNI Tree */
key_combos[i-1].order = ssl_sock_add_cert_sni(cur_ctx, bind_conf, ssl_conf,
- kinfo, str, key_combos[i-1].order);
+ kinfo, str, key_combos[i-1].order);
+ if (key_combos[i-1].order < 0) {
+ memprintf(err, "%sunable to create a sni context.\n", err && *err ? *err : "");
+ rv = 1;
+ goto end;
+ }
node = ebmb_next(node);
}
@@ -3370,8 +3375,11 @@
}
if (fcount) {
- while (fcount--)
+ while (fcount--) {
order = ssl_sock_add_cert_sni(ctx, s, ssl_conf, kinfo, sni_filter[fcount], order);
+ if (order < 0)
+ goto end;
+ }
}
else {
#ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME
@@ -3383,6 +3391,8 @@
if (ASN1_STRING_to_UTF8((unsigned char **)&str, name->d.dNSName) >= 0) {
order = ssl_sock_add_cert_sni(ctx, s, ssl_conf, kinfo, str, order);
OPENSSL_free(str);
+ if (order < 0)
+ goto end;
}
}
}
@@ -3399,6 +3409,8 @@
if (ASN1_STRING_to_UTF8((unsigned char **)&str, value) >= 0) {
order = ssl_sock_add_cert_sni(ctx, s, ssl_conf, kinfo, str, order);
OPENSSL_free(str);
+ if (order < 0)
+ goto end;
}
}
}