BUG/MINOR: ssl: default settings for ssl server options are not used
Documentation states that default settings for ssl server options can be set
using either ssl-default-server-options or default-server directives. In practice,
not all ssl server options can have default values, such as ssl-min-ver, ssl-max-ver,
etc..
This patch adds the missing ssl options in srv_ssl_settings_cpy() and srv_parse_ssl(),
making it possible to write configurations like the following examples, and have them
behave as expected.
global
ssl-default-server-options ssl-max-ver TLSv1.2
defaults
mode http
listen l1
bind 1.2.3.4:80
default-server ssl verify none
server s1 1.2.3.5:443
listen l2
bind 2.2.3.4:80
default-server ssl verify none ssl-max-ver TLSv1.3 ssl-min-ver TLSv1.2
server s1 1.2.3.6:443
This should be backported as far as 1.8.
This fixes issue #595.
(cherry picked from commit 2e8d52f869ed7673a8274ec7b045161e09350251)
Signed-off-by: Willy Tarreau <w@1wt.eu>
(cherry picked from commit bd0ace790d81fcbd3331f34db500bedb41fc4a89)
Signed-off-by: Willy Tarreau <w@1wt.eu>
diff --git a/src/ssl_sock.c b/src/ssl_sock.c
index d80b32e..c3b8ab2 100644
--- a/src/ssl_sock.c
+++ b/src/ssl_sock.c
@@ -8814,6 +8814,16 @@
if (global_ssl.connect_default_ciphersuites && !newsrv->ssl_ctx.ciphersuites)
newsrv->ssl_ctx.ciphersuites = strdup(global_ssl.connect_default_ciphersuites);
#endif
+ newsrv->ssl_ctx.options |= global_ssl.connect_default_ssloptions;
+ newsrv->ssl_ctx.methods.flags |= global_ssl.connect_default_sslmethods.flags;
+
+ if (!newsrv->ssl_ctx.methods.min)
+ newsrv->ssl_ctx.methods.min = global_ssl.connect_default_sslmethods.min;
+
+ if (!newsrv->ssl_ctx.methods.max)
+ newsrv->ssl_ctx.methods.max = global_ssl.connect_default_sslmethods.max;
+
+
return 0;
}