blob: 47e05929755c2e69ff1fae18b5e6da719c1b1872 [file] [log] [blame]
William Lallemanddad31052020-05-14 17:47:32 +02001/*
2 *
3 * Copyright (C) 2012 EXCELIANCE, Emeric Brun <ebrun@exceliance.fr>
4 * Copyright (C) 2020 HAProxy Technologies, William Lallemand <wlallemand@haproxy.com>
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 *
12 * Configuration parsing for SSL.
13 * This file is split in 3 parts:
14 * - global section parsing
15 * - bind keyword parsing
16 * - server keyword parsing
17 *
18 * Please insert the new keywords at the right place
19 */
20
21#define _GNU_SOURCE
22#include <ctype.h>
23#include <dirent.h>
24#include <errno.h>
25#include <fcntl.h>
26#include <stdio.h>
27#include <stdlib.h>
28#include <string.h>
29#include <unistd.h>
30
31#include <sys/stat.h>
32#include <sys/types.h>
33
Willy Tarreau4c7e4b72020-05-27 12:58:42 +020034#include <haproxy/api.h>
Willy Tarreau8d366972020-05-27 16:10:29 +020035#include <haproxy/base64.h>
Willy Tarreau6be78492020-06-05 00:00:29 +020036#include <haproxy/cfgparse.h>
Willy Tarreau213e9902020-06-04 14:58:24 +020037#include <haproxy/listener.h>
Willy Tarreau6019fab2020-05-27 16:26:00 +020038#include <haproxy/openssl-compat.h>
Willy Tarreau209108d2020-06-04 20:30:20 +020039#include <haproxy/ssl_sock.h>
William Lallemanddad31052020-05-14 17:47:32 +020040
41
42/****************** Global Section Parsing ********************************************/
43
44static int ssl_load_global_issuers_from_path(char **args, int section_type, struct proxy *curpx,
45 struct proxy *defpx, const char *file, int line,
46 char **err)
47{
48 char *path;
49 struct dirent **de_list;
50 int i, n;
51 struct stat buf;
52 char *end;
53 char fp[MAXPATHLEN+1];
54
55 if (too_many_args(1, args, err, NULL))
56 return -1;
57
58 path = args[1];
59 if (*path == 0 || stat(path, &buf)) {
60 memprintf(err, "%sglobal statement '%s' expects a directory path as an argument.\n",
61 err && *err ? *err : "", args[0]);
62 return -1;
63 }
64 if (S_ISDIR(buf.st_mode) == 0) {
65 memprintf(err, "%sglobal statement '%s': %s is not a directory.\n",
66 err && *err ? *err : "", args[0], path);
67 return -1;
68 }
69
70 /* strip trailing slashes, including first one */
71 for (end = path + strlen(path) - 1; end >= path && *end == '/'; end--)
72 *end = 0;
73 /* path already parsed? */
74 if (global_ssl.issuers_chain_path && strcmp(global_ssl.issuers_chain_path, path) == 0)
75 return 0;
76 /* overwrite old issuers_chain_path */
77 free(global_ssl.issuers_chain_path);
78 global_ssl.issuers_chain_path = strdup(path);
79 ssl_free_global_issuers();
80
81 n = scandir(path, &de_list, 0, alphasort);
82 if (n < 0) {
83 memprintf(err, "%sglobal statement '%s': unable to scan directory '%s' : %s.\n",
84 err && *err ? *err : "", args[0], path, strerror(errno));
85 return -1;
86 }
87 for (i = 0; i < n; i++) {
88 struct dirent *de = de_list[i];
89 BIO *in = NULL;
90 char *warn = NULL;
91
92 snprintf(fp, sizeof(fp), "%s/%s", path, de->d_name);
93 free(de);
94 if (stat(fp, &buf) != 0) {
95 ha_warning("unable to stat certificate from file '%s' : %s.\n", fp, strerror(errno));
96 goto next;
97 }
98 if (!S_ISREG(buf.st_mode))
99 goto next;
100
101 in = BIO_new(BIO_s_file());
102 if (in == NULL)
103 goto next;
104 if (BIO_read_filename(in, fp) <= 0)
105 goto next;
106 ssl_load_global_issuer_from_BIO(in, fp, &warn);
107 if (warn) {
108 ha_warning("%s", warn);
109 free(warn);
110 warn = NULL;
111 }
112 next:
113 if (in)
114 BIO_free(in);
115 }
116 free(de_list);
117
118 return 0;
119}
120
William Lallemanddad31052020-05-14 17:47:32 +0200121/* parse the "ssl-mode-async" keyword in global section.
122 * Returns <0 on alert, >0 on warning, 0 on success.
123 */
124static int ssl_parse_global_ssl_async(char **args, int section_type, struct proxy *curpx,
125 struct proxy *defpx, const char *file, int line,
126 char **err)
127{
Ilya Shipitsinbdec3ba2020-11-14 01:56:34 +0500128#ifdef SSL_MODE_ASYNC
William Lallemanddad31052020-05-14 17:47:32 +0200129 global_ssl.async = 1;
130 global.ssl_used_async_engines = nb_engines;
131 return 0;
132#else
133 memprintf(err, "'%s': openssl library does not support async mode", args[0]);
134 return -1;
135#endif
136}
137
William Lallemand5520d6f2020-05-18 13:42:49 +0200138#ifndef OPENSSL_NO_ENGINE
William Lallemanddad31052020-05-14 17:47:32 +0200139/* parse the "ssl-engine" keyword in global section.
140 * Returns <0 on alert, >0 on warning, 0 on success.
141 */
142static int ssl_parse_global_ssl_engine(char **args, int section_type, struct proxy *curpx,
143 struct proxy *defpx, const char *file, int line,
144 char **err)
145{
146 char *algo;
147 int ret = -1;
148
149 if (*(args[1]) == 0) {
150 memprintf(err, "global statement '%s' expects a valid engine name as an argument.", args[0]);
151 return ret;
152 }
153
154 if (*(args[2]) == 0) {
155 /* if no list of algorithms is given, it defaults to ALL */
156 algo = strdup("ALL");
157 goto add_engine;
158 }
159
160 /* otherwise the expected format is ssl-engine <engine_name> algo <list of algo> */
161 if (strcmp(args[2], "algo") != 0) {
162 memprintf(err, "global statement '%s' expects to have algo keyword.", args[0]);
163 return ret;
164 }
165
166 if (*(args[3]) == 0) {
167 memprintf(err, "global statement '%s' expects algorithm names as an argument.", args[0]);
168 return ret;
169 }
170 algo = strdup(args[3]);
171
172add_engine:
173 if (ssl_init_single_engine(args[1], algo)==0) {
174 openssl_engines_initialized++;
175 ret = 0;
176 }
177 free(algo);
178 return ret;
179}
180#endif
181
182/* parse the "ssl-default-bind-ciphers" / "ssl-default-server-ciphers" keywords
183 * in global section. Returns <0 on alert, >0 on warning, 0 on success.
184 */
185static int ssl_parse_global_ciphers(char **args, int section_type, struct proxy *curpx,
186 struct proxy *defpx, const char *file, int line,
187 char **err)
188{
189 char **target;
190
191 target = (args[0][12] == 'b') ? &global_ssl.listen_default_ciphers : &global_ssl.connect_default_ciphers;
192
193 if (too_many_args(1, args, err, NULL))
194 return -1;
195
196 if (*(args[1]) == 0) {
197 memprintf(err, "global statement '%s' expects a cipher suite as an argument.", args[0]);
198 return -1;
199 }
200
201 free(*target);
202 *target = strdup(args[1]);
203 return 0;
204}
205
Ilya Shipitsinf34ed0b2020-11-21 14:37:34 +0500206#ifdef HAVE_SSL_CTX_SET_CIPHERSUITES
William Lallemanddad31052020-05-14 17:47:32 +0200207/* parse the "ssl-default-bind-ciphersuites" / "ssl-default-server-ciphersuites" keywords
208 * in global section. Returns <0 on alert, >0 on warning, 0 on success.
209 */
210static int ssl_parse_global_ciphersuites(char **args, int section_type, struct proxy *curpx,
211 struct proxy *defpx, const char *file, int line,
212 char **err)
213{
214 char **target;
215
216 target = (args[0][12] == 'b') ? &global_ssl.listen_default_ciphersuites : &global_ssl.connect_default_ciphersuites;
217
218 if (too_many_args(1, args, err, NULL))
219 return -1;
220
221 if (*(args[1]) == 0) {
222 memprintf(err, "global statement '%s' expects a cipher suite as an argument.", args[0]);
223 return -1;
224 }
225
226 free(*target);
227 *target = strdup(args[1]);
228 return 0;
229}
230#endif
231
Ilya Shipitsin0aa8c292020-11-04 00:39:07 +0500232#if defined(SSL_CTX_set1_curves_list)
William Lallemanddad31052020-05-14 17:47:32 +0200233/*
234 * parse the "ssl-default-bind-curves" keyword in a global section.
235 * Returns <0 on alert, >0 on warning, 0 on success.
236 */
237static int ssl_parse_global_curves(char **args, int section_type, struct proxy *curpx,
238 struct proxy *defpx, const char *file, int line,
239 char **err)
240{
241 char **target;
242 target = &global_ssl.listen_default_curves;
243
244 if (too_many_args(1, args, err, NULL))
245 return -1;
246
247 if (*(args[1]) == 0) {
248 memprintf(err, "global statement '%s' expects a curves suite as an arguments.", args[0]);
249 return -1;
250 }
251
252 free(*target);
253 *target = strdup(args[1]);
254 return 0;
255}
256#endif
257/* parse various global tune.ssl settings consisting in positive integers.
258 * Returns <0 on alert, >0 on warning, 0 on success.
259 */
260static int ssl_parse_global_int(char **args, int section_type, struct proxy *curpx,
261 struct proxy *defpx, const char *file, int line,
262 char **err)
263{
264 int *target;
265
266 if (strcmp(args[0], "tune.ssl.cachesize") == 0)
267 target = &global.tune.sslcachesize;
268 else if (strcmp(args[0], "tune.ssl.maxrecord") == 0)
269 target = (int *)&global_ssl.max_record;
270 else if (strcmp(args[0], "tune.ssl.ssl-ctx-cache-size") == 0)
271 target = &global_ssl.ctx_cache;
272 else if (strcmp(args[0], "maxsslconn") == 0)
273 target = &global.maxsslconn;
274 else if (strcmp(args[0], "tune.ssl.capture-cipherlist-size") == 0)
275 target = &global_ssl.capture_cipherlist;
276 else {
277 memprintf(err, "'%s' keyword not unhandled (please report this bug).", args[0]);
278 return -1;
279 }
280
281 if (too_many_args(1, args, err, NULL))
282 return -1;
283
284 if (*(args[1]) == 0) {
285 memprintf(err, "'%s' expects an integer argument.", args[0]);
286 return -1;
287 }
288
289 *target = atoi(args[1]);
290 if (*target < 0) {
291 memprintf(err, "'%s' expects a positive numeric value.", args[0]);
292 return -1;
293 }
294 return 0;
295}
296
297static int ssl_parse_global_capture_cipherlist(char **args, int section_type, struct proxy *curpx,
298 struct proxy *defpx, const char *file, int line,
299 char **err)
300{
301 int ret;
302
303 ret = ssl_parse_global_int(args, section_type, curpx, defpx, file, line, err);
304 if (ret != 0)
305 return ret;
306
307 if (pool_head_ssl_capture) {
308 memprintf(err, "'%s' is already configured.", args[0]);
309 return -1;
310 }
311
312 pool_head_ssl_capture = create_pool("ssl-capture", sizeof(struct ssl_capture) + global_ssl.capture_cipherlist, MEM_F_SHARED);
313 if (!pool_head_ssl_capture) {
314 memprintf(err, "Out of memory error.");
315 return -1;
316 }
317 return 0;
318}
319
William Lallemand7d42ef52020-07-06 11:41:30 +0200320/* init the SSLKEYLOGFILE pool */
Ilya Shipitsin04a5a442020-11-03 14:15:38 +0500321#ifdef HAVE_OPENSSL_KEYLOG
William Lallemand7d42ef52020-07-06 11:41:30 +0200322static int ssl_parse_global_keylog(char **args, int section_type, struct proxy *curpx,
323 struct proxy *defpx, const char *file, int line,
324 char **err)
325{
326
327 if (too_many_args(1, args, err, NULL))
328 return -1;
329
330 if (strcmp(args[1], "on") == 0)
331 global_ssl.keylog = 1;
332 else if (strcmp(args[1], "off") == 0)
333 global_ssl.keylog = 0;
334 else {
335 memprintf(err, "'%s' expects either 'on' or 'off' but got '%s'.", args[0], args[1]);
336 return -1;
337 }
338
339 if (pool_head_ssl_keylog) /* already configured */
340 return 0;
341
342 pool_head_ssl_keylog = create_pool("ssl-keylogfile", sizeof(struct ssl_keylog), MEM_F_SHARED);
343 if (!pool_head_ssl_keylog) {
344 memprintf(err, "Out of memory error.");
345 return -1;
346 }
347
348 pool_head_ssl_keylog_str = create_pool("ssl-keylogfile-str", sizeof(char) * SSL_KEYLOG_MAX_SECRET_SIZE, MEM_F_SHARED);
349 if (!pool_head_ssl_keylog_str) {
350 memprintf(err, "Out of memory error.");
351 return -1;
352 }
353
354 return 0;
355}
356#endif
357
William Lallemanddad31052020-05-14 17:47:32 +0200358/* parse "ssl.force-private-cache".
359 * Returns <0 on alert, >0 on warning, 0 on success.
360 */
361static int ssl_parse_global_private_cache(char **args, int section_type, struct proxy *curpx,
362 struct proxy *defpx, const char *file, int line,
363 char **err)
364{
365 if (too_many_args(0, args, err, NULL))
366 return -1;
367
368 global_ssl.private_cache = 1;
369 return 0;
370}
371
372/* parse "ssl.lifetime".
373 * Returns <0 on alert, >0 on warning, 0 on success.
374 */
375static int ssl_parse_global_lifetime(char **args, int section_type, struct proxy *curpx,
376 struct proxy *defpx, const char *file, int line,
377 char **err)
378{
379 const char *res;
380
381 if (too_many_args(1, args, err, NULL))
382 return -1;
383
384 if (*(args[1]) == 0) {
385 memprintf(err, "'%s' expects ssl sessions <lifetime> in seconds as argument.", args[0]);
386 return -1;
387 }
388
389 res = parse_time_err(args[1], &global_ssl.life_time, TIME_UNIT_S);
390 if (res == PARSE_TIME_OVER) {
391 memprintf(err, "timer overflow in argument '%s' to <%s> (maximum value is 2147483647 s or ~68 years).",
392 args[1], args[0]);
393 return -1;
394 }
395 else if (res == PARSE_TIME_UNDER) {
396 memprintf(err, "timer underflow in argument '%s' to <%s> (minimum non-null value is 1 s).",
397 args[1], args[0]);
398 return -1;
399 }
400 else if (res) {
401 memprintf(err, "unexpected character '%c' in argument to <%s>.", *res, args[0]);
402 return -1;
403 }
404 return 0;
405}
406
407#ifndef OPENSSL_NO_DH
408/* parse "ssl-dh-param-file".
409 * Returns <0 on alert, >0 on warning, 0 on success.
410 */
411static int ssl_parse_global_dh_param_file(char **args, int section_type, struct proxy *curpx,
412 struct proxy *defpx, const char *file, int line,
413 char **err)
414{
415 if (too_many_args(1, args, err, NULL))
416 return -1;
417
418 if (*(args[1]) == 0) {
419 memprintf(err, "'%s' expects a file path as an argument.", args[0]);
420 return -1;
421 }
422
423 if (ssl_sock_load_global_dh_param_from_file(args[1])) {
424 memprintf(err, "'%s': unable to load DH parameters from file <%s>.", args[0], args[1]);
425 return -1;
426 }
427 return 0;
428}
429
430/* parse "ssl.default-dh-param".
431 * Returns <0 on alert, >0 on warning, 0 on success.
432 */
433static int ssl_parse_global_default_dh(char **args, int section_type, struct proxy *curpx,
434 struct proxy *defpx, const char *file, int line,
435 char **err)
436{
437 if (too_many_args(1, args, err, NULL))
438 return -1;
439
440 if (*(args[1]) == 0) {
441 memprintf(err, "'%s' expects an integer argument.", args[0]);
442 return -1;
443 }
444
445 global_ssl.default_dh_param = atoi(args[1]);
446 if (global_ssl.default_dh_param < 1024) {
447 memprintf(err, "'%s' expects a value >= 1024.", args[0]);
448 return -1;
449 }
450 return 0;
451}
452#endif
453
454
455/*
456 * parse "ssl-load-extra-files".
457 * multiple arguments are allowed: "bundle", "sctl", "ocsp", "issuer", "all", "none"
458 */
459static int ssl_parse_global_extra_files(char **args, int section_type, struct proxy *curpx,
460 struct proxy *defpx, const char *file, int line,
461 char **err)
462{
463 int i;
464 int gf = SSL_GF_NONE;
465
466 if (*(args[1]) == 0)
467 goto err_arg;
468
469 for (i = 1; *args[i]; i++) {
470
471 if (!strcmp("bundle", args[i])) {
472 gf |= SSL_GF_BUNDLE;
473
474 } else if (!strcmp("sctl", args[i])) {
475 gf |= SSL_GF_SCTL;
476
477 } else if (!strcmp("ocsp", args[i])){
478 gf |= SSL_GF_OCSP;
479
480 } else if (!strcmp("issuer", args[i])){
481 gf |= SSL_GF_OCSP_ISSUER;
482
483 } else if (!strcmp("key", args[i])) {
484 gf |= SSL_GF_KEY;
485
486 } else if (!strcmp("none", args[i])) {
487 if (gf != SSL_GF_NONE)
488 goto err_alone;
489 gf = SSL_GF_NONE;
490 i++;
491 break;
492
493 } else if (!strcmp("all", args[i])) {
494 if (gf != SSL_GF_NONE)
495 goto err_alone;
496 gf = SSL_GF_ALL;
497 i++;
498 break;
499 } else {
500 goto err_arg;
501 }
502 }
503 /* break from loop but there are still arguments */
504 if (*args[i])
505 goto err_alone;
506
507 global_ssl.extra_files = gf;
508
509 return 0;
510
511err_alone:
512 memprintf(err, "'%s' 'none' and 'all' can be only used alone", args[0]);
513 return -1;
514
515err_arg:
516 memprintf(err, "'%s' expects one or multiple arguments (none, all, bundle, sctl, ocsp, issuer).", args[0]);
517 return -1;
518}
519
520
William Lallemand8e8581e2020-10-20 17:36:46 +0200521/* parse 'ssl-load-extra-del-ext */
522static int ssl_parse_global_extra_noext(char **args, int section_type, struct proxy *curpx,
523 struct proxy *defpx, const char *file, int line,
524 char **err)
525{
526 global_ssl.extra_files_noext = 1;
527 return 0;
528}
529
William Lallemanddad31052020-05-14 17:47:32 +0200530/***************************** Bind keyword Parsing ********************************************/
531
532/* for ca-file and ca-verify-file */
533static int ssl_bind_parse_ca_file_common(char **args, int cur_arg, char **ca_file_p, char **err)
534{
535 if (!*args[cur_arg + 1]) {
536 memprintf(err, "'%s' : missing CAfile path", args[cur_arg]);
537 return ERR_ALERT | ERR_FATAL;
538 }
539
540 if ((*args[cur_arg + 1] != '/') && global_ssl.ca_base)
541 memprintf(ca_file_p, "%s/%s", global_ssl.ca_base, args[cur_arg + 1]);
542 else
543 memprintf(ca_file_p, "%s", args[cur_arg + 1]);
544
545 if (!ssl_store_load_locations_file(*ca_file_p)) {
546 memprintf(err, "'%s' : unable to load %s", args[cur_arg], *ca_file_p);
547 return ERR_ALERT | ERR_FATAL;
548 }
549 return 0;
550}
551
552/* parse the "ca-file" bind keyword */
553static int ssl_bind_parse_ca_file(char **args, int cur_arg, struct proxy *px, struct ssl_bind_conf *conf, char **err)
554{
555 return ssl_bind_parse_ca_file_common(args, cur_arg, &conf->ca_file, err);
556}
557static int bind_parse_ca_file(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
558{
559 return ssl_bind_parse_ca_file(args, cur_arg, px, &conf->ssl_conf, err);
560}
561
562/* parse the "ca-verify-file" bind keyword */
563static int ssl_bind_parse_ca_verify_file(char **args, int cur_arg, struct proxy *px, struct ssl_bind_conf *conf, char **err)
564{
565 return ssl_bind_parse_ca_file_common(args, cur_arg, &conf->ca_verify_file, err);
566}
567static int bind_parse_ca_verify_file(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
568{
569 return ssl_bind_parse_ca_verify_file(args, cur_arg, px, &conf->ssl_conf, err);
570}
571
572/* parse the "ca-sign-file" bind keyword */
573static int bind_parse_ca_sign_file(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
574{
575 if (!*args[cur_arg + 1]) {
576 memprintf(err, "'%s' : missing CAfile path", args[cur_arg]);
577 return ERR_ALERT | ERR_FATAL;
578 }
579
580 if ((*args[cur_arg + 1] != '/') && global_ssl.ca_base)
581 memprintf(&conf->ca_sign_file, "%s/%s", global_ssl.ca_base, args[cur_arg + 1]);
582 else
583 memprintf(&conf->ca_sign_file, "%s", args[cur_arg + 1]);
584
585 return 0;
586}
587
588/* parse the "ca-sign-pass" bind keyword */
589static int bind_parse_ca_sign_pass(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
590{
591 if (!*args[cur_arg + 1]) {
592 memprintf(err, "'%s' : missing CAkey password", args[cur_arg]);
593 return ERR_ALERT | ERR_FATAL;
594 }
595 memprintf(&conf->ca_sign_pass, "%s", args[cur_arg + 1]);
596 return 0;
597}
598
599/* parse the "ciphers" bind keyword */
600static int ssl_bind_parse_ciphers(char **args, int cur_arg, struct proxy *px, struct ssl_bind_conf *conf, char **err)
601{
602 if (!*args[cur_arg + 1]) {
603 memprintf(err, "'%s' : missing cipher suite", args[cur_arg]);
604 return ERR_ALERT | ERR_FATAL;
605 }
606
607 free(conf->ciphers);
608 conf->ciphers = strdup(args[cur_arg + 1]);
609 return 0;
610}
611static int bind_parse_ciphers(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
612{
613 return ssl_bind_parse_ciphers(args, cur_arg, px, &conf->ssl_conf, err);
614}
615
Ilya Shipitsinf34ed0b2020-11-21 14:37:34 +0500616#ifdef HAVE_SSL_CTX_SET_CIPHERSUITES
William Lallemanddad31052020-05-14 17:47:32 +0200617/* parse the "ciphersuites" bind keyword */
618static int ssl_bind_parse_ciphersuites(char **args, int cur_arg, struct proxy *px, struct ssl_bind_conf *conf, char **err)
619{
620 if (!*args[cur_arg + 1]) {
621 memprintf(err, "'%s' : missing cipher suite", args[cur_arg]);
622 return ERR_ALERT | ERR_FATAL;
623 }
624
625 free(conf->ciphersuites);
626 conf->ciphersuites = strdup(args[cur_arg + 1]);
627 return 0;
628}
629static int bind_parse_ciphersuites(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
630{
631 return ssl_bind_parse_ciphersuites(args, cur_arg, px, &conf->ssl_conf, err);
632}
633#endif
634
635/* parse the "crt" bind keyword. Returns a set of ERR_* flags possibly with an error in <err>. */
636static int bind_parse_crt(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
637{
638 char path[MAXPATHLEN];
639
640 if (!*args[cur_arg + 1]) {
641 memprintf(err, "'%s' : missing certificate location", args[cur_arg]);
642 return ERR_ALERT | ERR_FATAL;
643 }
644
645 if ((*args[cur_arg + 1] != '/' ) && global_ssl.crt_base) {
646 if ((strlen(global_ssl.crt_base) + 1 + strlen(args[cur_arg + 1]) + 1) > MAXPATHLEN) {
647 memprintf(err, "'%s' : path too long", args[cur_arg]);
648 return ERR_ALERT | ERR_FATAL;
649 }
650 snprintf(path, sizeof(path), "%s/%s", global_ssl.crt_base, args[cur_arg + 1]);
651 return ssl_sock_load_cert(path, conf, err);
652 }
653
654 return ssl_sock_load_cert(args[cur_arg + 1], conf, err);
655}
656
657/* parse the "crt-list" bind keyword. Returns a set of ERR_* flags possibly with an error in <err>. */
658static int bind_parse_crt_list(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
659{
660 int err_code;
661
662 if (!*args[cur_arg + 1]) {
663 memprintf(err, "'%s' : missing certificate location", args[cur_arg]);
664 return ERR_ALERT | ERR_FATAL;
665 }
666
667 err_code = ssl_sock_load_cert_list_file(args[cur_arg + 1], 0, conf, px, err);
668 if (err_code)
669 memprintf(err, "'%s' : %s", args[cur_arg], *err);
670
671 return err_code;
672}
673
674/* parse the "crl-file" bind keyword */
675static int ssl_bind_parse_crl_file(char **args, int cur_arg, struct proxy *px, struct ssl_bind_conf *conf, char **err)
676{
677#ifndef X509_V_FLAG_CRL_CHECK
678 memprintf(err, "'%s' : library does not support CRL verify", args[cur_arg]);
679 return ERR_ALERT | ERR_FATAL;
680#else
681 if (!*args[cur_arg + 1]) {
682 memprintf(err, "'%s' : missing CRLfile path", args[cur_arg]);
683 return ERR_ALERT | ERR_FATAL;
684 }
685
686 if ((*args[cur_arg + 1] != '/') && global_ssl.ca_base)
687 memprintf(&conf->crl_file, "%s/%s", global_ssl.ca_base, args[cur_arg + 1]);
688 else
689 memprintf(&conf->crl_file, "%s", args[cur_arg + 1]);
690
691 if (!ssl_store_load_locations_file(conf->crl_file)) {
692 memprintf(err, "'%s' : unable to load %s", args[cur_arg], conf->crl_file);
693 return ERR_ALERT | ERR_FATAL;
694 }
695 return 0;
696#endif
697}
698static int bind_parse_crl_file(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
699{
700 return ssl_bind_parse_crl_file(args, cur_arg, px, &conf->ssl_conf, err);
701}
702
703/* parse the "curves" bind keyword keyword */
704static int ssl_bind_parse_curves(char **args, int cur_arg, struct proxy *px, struct ssl_bind_conf *conf, char **err)
705{
Ilya Shipitsin0aa8c292020-11-04 00:39:07 +0500706#if defined(SSL_CTX_set1_curves_list)
William Lallemanddad31052020-05-14 17:47:32 +0200707 if (!*args[cur_arg + 1]) {
708 memprintf(err, "'%s' : missing curve suite", args[cur_arg]);
709 return ERR_ALERT | ERR_FATAL;
710 }
711 conf->curves = strdup(args[cur_arg + 1]);
712 return 0;
713#else
714 memprintf(err, "'%s' : library does not support curve suite", args[cur_arg]);
715 return ERR_ALERT | ERR_FATAL;
716#endif
717}
718static int bind_parse_curves(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
719{
720 return ssl_bind_parse_curves(args, cur_arg, px, &conf->ssl_conf, err);
721}
722
723/* parse the "ecdhe" bind keyword keyword */
724static int ssl_bind_parse_ecdhe(char **args, int cur_arg, struct proxy *px, struct ssl_bind_conf *conf, char **err)
725{
726#if HA_OPENSSL_VERSION_NUMBER < 0x0090800fL
727 memprintf(err, "'%s' : library does not support elliptic curve Diffie-Hellman (too old)", args[cur_arg]);
728 return ERR_ALERT | ERR_FATAL;
729#elif defined(OPENSSL_NO_ECDH)
730 memprintf(err, "'%s' : library does not support elliptic curve Diffie-Hellman (disabled via OPENSSL_NO_ECDH)", args[cur_arg]);
731 return ERR_ALERT | ERR_FATAL;
732#else
733 if (!*args[cur_arg + 1]) {
734 memprintf(err, "'%s' : missing named curve", args[cur_arg]);
735 return ERR_ALERT | ERR_FATAL;
736 }
737
738 conf->ecdhe = strdup(args[cur_arg + 1]);
739
740 return 0;
741#endif
742}
743static int bind_parse_ecdhe(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
744{
745 return ssl_bind_parse_ecdhe(args, cur_arg, px, &conf->ssl_conf, err);
746}
747
748/* parse the "crt-ignore-err" and "ca-ignore-err" bind keywords */
749static int bind_parse_ignore_err(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
750{
751 int code;
752 char *p = args[cur_arg + 1];
753 unsigned long long *ignerr = &conf->crt_ignerr;
754
755 if (!*p) {
756 memprintf(err, "'%s' : missing error IDs list", args[cur_arg]);
757 return ERR_ALERT | ERR_FATAL;
758 }
759
760 if (strcmp(args[cur_arg], "ca-ignore-err") == 0)
761 ignerr = &conf->ca_ignerr;
762
763 if (strcmp(p, "all") == 0) {
764 *ignerr = ~0ULL;
765 return 0;
766 }
767
768 while (p) {
769 code = atoi(p);
770 if ((code <= 0) || (code > 63)) {
771 memprintf(err, "'%s' : ID '%d' out of range (1..63) in error IDs list '%s'",
772 args[cur_arg], code, args[cur_arg + 1]);
773 return ERR_ALERT | ERR_FATAL;
774 }
775 *ignerr |= 1ULL << code;
776 p = strchr(p, ',');
777 if (p)
778 p++;
779 }
780
781 return 0;
782}
783
784/* parse tls_method_options "no-xxx" and "force-xxx" */
785static int parse_tls_method_options(char *arg, struct tls_version_filter *methods, char **err)
786{
787 uint16_t v;
788 char *p;
789 p = strchr(arg, '-');
790 if (!p)
791 goto fail;
792 p++;
793 if (!strcmp(p, "sslv3"))
794 v = CONF_SSLV3;
795 else if (!strcmp(p, "tlsv10"))
796 v = CONF_TLSV10;
797 else if (!strcmp(p, "tlsv11"))
798 v = CONF_TLSV11;
799 else if (!strcmp(p, "tlsv12"))
800 v = CONF_TLSV12;
801 else if (!strcmp(p, "tlsv13"))
802 v = CONF_TLSV13;
803 else
804 goto fail;
805 if (!strncmp(arg, "no-", 3))
806 methods->flags |= methodVersions[v].flag;
807 else if (!strncmp(arg, "force-", 6))
808 methods->min = methods->max = v;
809 else
810 goto fail;
811 return 0;
812 fail:
813 memprintf(err, "'%s' : option not implemented", arg);
814 return ERR_ALERT | ERR_FATAL;
815}
816
817static int bind_parse_tls_method_options(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
818{
819 return parse_tls_method_options(args[cur_arg], &conf->ssl_conf.ssl_methods, err);
820}
821
822static int srv_parse_tls_method_options(char **args, int *cur_arg, struct proxy *px, struct server *newsrv, char **err)
823{
824 return parse_tls_method_options(args[*cur_arg], &newsrv->ssl_ctx.methods, err);
825}
826
827/* parse tls_method min/max: "ssl-min-ver" and "ssl-max-ver" */
828static int parse_tls_method_minmax(char **args, int cur_arg, struct tls_version_filter *methods, char **err)
829{
830 uint16_t i, v = 0;
831 char *argv = args[cur_arg + 1];
832 if (!*argv) {
833 memprintf(err, "'%s' : missing the ssl/tls version", args[cur_arg]);
834 return ERR_ALERT | ERR_FATAL;
835 }
836 for (i = CONF_TLSV_MIN; i <= CONF_TLSV_MAX; i++)
837 if (!strcmp(argv, methodVersions[i].name))
838 v = i;
839 if (!v) {
840 memprintf(err, "'%s' : unknown ssl/tls version", args[cur_arg + 1]);
841 return ERR_ALERT | ERR_FATAL;
842 }
843 if (!strcmp("ssl-min-ver", args[cur_arg]))
844 methods->min = v;
845 else if (!strcmp("ssl-max-ver", args[cur_arg]))
846 methods->max = v;
847 else {
848 memprintf(err, "'%s' : option not implemented", args[cur_arg]);
849 return ERR_ALERT | ERR_FATAL;
850 }
851 return 0;
852}
853
854static int ssl_bind_parse_tls_method_minmax(char **args, int cur_arg, struct proxy *px, struct ssl_bind_conf *conf, char **err)
855{
William Lallemand8177ad92020-05-20 16:49:02 +0200856 int ret;
857
William Lallemanddad31052020-05-14 17:47:32 +0200858#if (HA_OPENSSL_VERSION_NUMBER < 0x10101000L) && !defined(OPENSSL_IS_BORINGSSL)
859 ha_warning("crt-list: ssl-min-ver and ssl-max-ver are not supported with this Openssl version (skipped).\n");
860#endif
William Lallemand8177ad92020-05-20 16:49:02 +0200861 ret = parse_tls_method_minmax(args, cur_arg, &conf->ssl_methods_cfg, err);
862 if (ret != ERR_NONE)
863 return ret;
William Lallemanddad31052020-05-14 17:47:32 +0200864
William Lallemand8177ad92020-05-20 16:49:02 +0200865 conf->ssl_methods.min = conf->ssl_methods_cfg.min;
866 conf->ssl_methods.max = conf->ssl_methods_cfg.max;
867
868 return ret;
869}
William Lallemanddad31052020-05-14 17:47:32 +0200870static int bind_parse_tls_method_minmax(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
871{
872 return parse_tls_method_minmax(args, cur_arg, &conf->ssl_conf.ssl_methods, err);
873}
874
875static int srv_parse_tls_method_minmax(char **args, int *cur_arg, struct proxy *px, struct server *newsrv, char **err)
876{
877 return parse_tls_method_minmax(args, *cur_arg, &newsrv->ssl_ctx.methods, err);
878}
879
880/* parse the "no-tls-tickets" bind keyword */
881static int bind_parse_no_tls_tickets(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
882{
883 conf->ssl_options |= BC_SSL_O_NO_TLS_TICKETS;
884 return 0;
885}
886
887/* parse the "allow-0rtt" bind keyword */
888static int ssl_bind_parse_allow_0rtt(char **args, int cur_arg, struct proxy *px, struct ssl_bind_conf *conf, char **err)
889{
890 conf->early_data = 1;
891 return 0;
892}
893
894static int bind_parse_allow_0rtt(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
895{
896 conf->ssl_conf.early_data = 1;
897 return 0;
898}
899
900/* parse the "npn" bind keyword */
901static int ssl_bind_parse_npn(char **args, int cur_arg, struct proxy *px, struct ssl_bind_conf *conf, char **err)
902{
903#if defined(OPENSSL_NPN_NEGOTIATED) && !defined(OPENSSL_NO_NEXTPROTONEG)
904 char *p1, *p2;
905
906 if (!*args[cur_arg + 1]) {
907 memprintf(err, "'%s' : missing the comma-delimited NPN protocol suite", args[cur_arg]);
908 return ERR_ALERT | ERR_FATAL;
909 }
910
911 free(conf->npn_str);
912
913 /* the NPN string is built as a suite of (<len> <name>)*,
914 * so we reuse each comma to store the next <len> and need
915 * one more for the end of the string.
916 */
917 conf->npn_len = strlen(args[cur_arg + 1]) + 1;
918 conf->npn_str = calloc(1, conf->npn_len + 1);
919 memcpy(conf->npn_str + 1, args[cur_arg + 1], conf->npn_len);
920
921 /* replace commas with the name length */
922 p1 = conf->npn_str;
923 p2 = p1 + 1;
924 while (1) {
925 p2 = memchr(p1 + 1, ',', conf->npn_str + conf->npn_len - (p1 + 1));
926 if (!p2)
927 p2 = p1 + 1 + strlen(p1 + 1);
928
929 if (p2 - (p1 + 1) > 255) {
930 *p2 = '\0';
931 memprintf(err, "'%s' : NPN protocol name too long : '%s'", args[cur_arg], p1 + 1);
932 return ERR_ALERT | ERR_FATAL;
933 }
934
935 *p1 = p2 - (p1 + 1);
936 p1 = p2;
937
938 if (!*p2)
939 break;
940
941 *(p2++) = '\0';
942 }
943 return 0;
944#else
945 memprintf(err, "'%s' : library does not support TLS NPN extension", args[cur_arg]);
946 return ERR_ALERT | ERR_FATAL;
947#endif
948}
949
950static int bind_parse_npn(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
951{
952 return ssl_bind_parse_npn(args, cur_arg, px, &conf->ssl_conf, err);
953}
954
955
956/* Parses a alpn string and converts it to the right format for the SSL api */
957int ssl_sock_parse_alpn(char *arg, char **alpn_str, int *alpn_len, char **err)
958{
959 char *p1, *p2, *alpn = NULL;
960 int len, ret = 0;
961
962 *alpn_str = NULL;
963 *alpn_len = 0;
964
965 if (!*arg) {
966 memprintf(err, "missing the comma-delimited ALPN protocol suite");
967 goto error;
968 }
969
970 /* the ALPN string is built as a suite of (<len> <name>)*,
971 * so we reuse each comma to store the next <len> and need
972 * one more for the end of the string.
973 */
974 len = strlen(arg) + 1;
975 alpn = calloc(1, len+1);
976 if (!alpn) {
977 memprintf(err, "'%s' : out of memory", arg);
978 goto error;
979 }
980 memcpy(alpn+1, arg, len);
981
982 /* replace commas with the name length */
983 p1 = alpn;
984 p2 = p1 + 1;
985 while (1) {
986 p2 = memchr(p1 + 1, ',', alpn + len - (p1 + 1));
987 if (!p2)
988 p2 = p1 + 1 + strlen(p1 + 1);
989
990 if (p2 - (p1 + 1) > 255) {
991 *p2 = '\0';
992 memprintf(err, "ALPN protocol name too long : '%s'", p1 + 1);
993 goto error;
994 }
995
996 *p1 = p2 - (p1 + 1);
997 p1 = p2;
998
999 if (!*p2)
1000 break;
1001
1002 *(p2++) = '\0';
1003 }
1004
1005 *alpn_str = alpn;
1006 *alpn_len = len;
1007
1008 out:
1009 return ret;
1010
1011 error:
1012 free(alpn);
1013 ret = ERR_ALERT | ERR_FATAL;
1014 goto out;
1015}
1016
1017/* parse the "alpn" bind keyword */
1018static int ssl_bind_parse_alpn(char **args, int cur_arg, struct proxy *px, struct ssl_bind_conf *conf, char **err)
1019{
1020#ifdef TLSEXT_TYPE_application_layer_protocol_negotiation
1021 int ret;
1022
1023 free(conf->alpn_str);
1024
1025 ret = ssl_sock_parse_alpn(args[cur_arg + 1], &conf->alpn_str, &conf->alpn_len, err);
1026 if (ret)
1027 memprintf(err, "'%s' : %s", args[cur_arg], *err);
1028 return ret;
1029#else
1030 memprintf(err, "'%s' : library does not support TLS ALPN extension", args[cur_arg]);
1031 return ERR_ALERT | ERR_FATAL;
1032#endif
1033}
1034
1035static int bind_parse_alpn(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
1036{
1037 return ssl_bind_parse_alpn(args, cur_arg, px, &conf->ssl_conf, err);
1038}
1039
1040/* parse the "ssl" bind keyword */
1041static int bind_parse_ssl(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
1042{
1043 conf->xprt = &ssl_sock;
1044 conf->is_ssl = 1;
1045
1046 if (global_ssl.listen_default_ciphers && !conf->ssl_conf.ciphers)
1047 conf->ssl_conf.ciphers = strdup(global_ssl.listen_default_ciphers);
Ilya Shipitsin0aa8c292020-11-04 00:39:07 +05001048#if defined(SSL_CTX_set1_curves_list)
William Lallemanddad31052020-05-14 17:47:32 +02001049 if (global_ssl.listen_default_curves && !conf->ssl_conf.curves)
1050 conf->ssl_conf.curves = strdup(global_ssl.listen_default_curves);
1051#endif
Ilya Shipitsinf34ed0b2020-11-21 14:37:34 +05001052#ifdef HAVE_SSL_CTX_SET_CIPHERSUITES
William Lallemanddad31052020-05-14 17:47:32 +02001053 if (global_ssl.listen_default_ciphersuites && !conf->ssl_conf.ciphersuites)
1054 conf->ssl_conf.ciphersuites = strdup(global_ssl.listen_default_ciphersuites);
1055#endif
1056 conf->ssl_options |= global_ssl.listen_default_ssloptions;
1057 conf->ssl_conf.ssl_methods.flags |= global_ssl.listen_default_sslmethods.flags;
1058 if (!conf->ssl_conf.ssl_methods.min)
1059 conf->ssl_conf.ssl_methods.min = global_ssl.listen_default_sslmethods.min;
1060 if (!conf->ssl_conf.ssl_methods.max)
1061 conf->ssl_conf.ssl_methods.max = global_ssl.listen_default_sslmethods.max;
1062
1063 return 0;
1064}
1065
1066/* parse the "prefer-client-ciphers" bind keyword */
1067static int bind_parse_pcc(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
1068{
1069 conf->ssl_options |= BC_SSL_O_PREF_CLIE_CIPH;
1070 return 0;
1071}
1072
1073/* parse the "generate-certificates" bind keyword */
1074static int bind_parse_generate_certs(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
1075{
1076#if (defined SSL_CTRL_SET_TLSEXT_HOSTNAME && !defined SSL_NO_GENERATE_CERTIFICATES)
1077 conf->generate_certs = 1;
1078#else
1079 memprintf(err, "%sthis version of openssl cannot generate SSL certificates.\n",
1080 err && *err ? *err : "");
1081#endif
1082 return 0;
1083}
1084
1085/* parse the "strict-sni" bind keyword */
1086static int bind_parse_strict_sni(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
1087{
1088 conf->strict_sni = 1;
1089 return 0;
1090}
1091
1092/* parse the "tls-ticket-keys" bind keyword */
1093static int bind_parse_tls_ticket_keys(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
1094{
1095#if (defined SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB && TLS_TICKETS_NO > 0)
1096 FILE *f = NULL;
1097 int i = 0;
1098 char thisline[LINESIZE];
1099 struct tls_keys_ref *keys_ref = NULL;
1100
1101 if (!*args[cur_arg + 1]) {
1102 memprintf(err, "'%s' : missing TLS ticket keys file path", args[cur_arg]);
1103 goto fail;
1104 }
1105
1106 keys_ref = tlskeys_ref_lookup(args[cur_arg + 1]);
1107 if (keys_ref) {
1108 keys_ref->refcount++;
1109 conf->keys_ref = keys_ref;
1110 return 0;
1111 }
1112
1113 keys_ref = calloc(1, sizeof(*keys_ref));
1114 if (!keys_ref) {
1115 memprintf(err, "'%s' : allocation error", args[cur_arg+1]);
1116 goto fail;
1117 }
1118
1119 keys_ref->tlskeys = malloc(TLS_TICKETS_NO * sizeof(union tls_sess_key));
1120 if (!keys_ref->tlskeys) {
1121 memprintf(err, "'%s' : allocation error", args[cur_arg+1]);
1122 goto fail;
1123 }
1124
1125 if ((f = fopen(args[cur_arg + 1], "r")) == NULL) {
1126 memprintf(err, "'%s' : unable to load ssl tickets keys file", args[cur_arg+1]);
1127 goto fail;
1128 }
1129
1130 keys_ref->filename = strdup(args[cur_arg + 1]);
1131 if (!keys_ref->filename) {
1132 memprintf(err, "'%s' : allocation error", args[cur_arg+1]);
1133 goto fail;
1134 }
1135
1136 keys_ref->key_size_bits = 0;
1137 while (fgets(thisline, sizeof(thisline), f) != NULL) {
1138 int len = strlen(thisline);
1139 int dec_size;
1140
1141 /* Strip newline characters from the end */
1142 if(thisline[len - 1] == '\n')
1143 thisline[--len] = 0;
1144
1145 if(thisline[len - 1] == '\r')
1146 thisline[--len] = 0;
1147
1148 dec_size = base64dec(thisline, len, (char *) (keys_ref->tlskeys + i % TLS_TICKETS_NO), sizeof(union tls_sess_key));
1149 if (dec_size < 0) {
1150 memprintf(err, "'%s' : unable to decode base64 key on line %d", args[cur_arg+1], i + 1);
1151 goto fail;
1152 }
1153 else if (!keys_ref->key_size_bits && (dec_size == sizeof(struct tls_sess_key_128))) {
1154 keys_ref->key_size_bits = 128;
1155 }
1156 else if (!keys_ref->key_size_bits && (dec_size == sizeof(struct tls_sess_key_256))) {
1157 keys_ref->key_size_bits = 256;
1158 }
1159 else if (((dec_size != sizeof(struct tls_sess_key_128)) && (dec_size != sizeof(struct tls_sess_key_256)))
1160 || ((dec_size == sizeof(struct tls_sess_key_128) && (keys_ref->key_size_bits != 128)))
1161 || ((dec_size == sizeof(struct tls_sess_key_256) && (keys_ref->key_size_bits != 256)))) {
1162 memprintf(err, "'%s' : wrong sized key on line %d", args[cur_arg+1], i + 1);
1163 goto fail;
1164 }
1165 i++;
1166 }
1167
1168 if (i < TLS_TICKETS_NO) {
1169 memprintf(err, "'%s' : please supply at least %d keys in the tls-tickets-file", args[cur_arg+1], TLS_TICKETS_NO);
1170 goto fail;
1171 }
1172
1173 fclose(f);
1174
1175 /* Use penultimate key for encryption, handle when TLS_TICKETS_NO = 1 */
1176 i -= 2;
1177 keys_ref->tls_ticket_enc_index = i < 0 ? 0 : i % TLS_TICKETS_NO;
1178 keys_ref->unique_id = -1;
1179 keys_ref->refcount = 1;
1180 HA_RWLOCK_INIT(&keys_ref->lock);
1181 conf->keys_ref = keys_ref;
1182
1183 LIST_ADD(&tlskeys_reference, &keys_ref->list);
1184
1185 return 0;
1186
1187 fail:
1188 if (f)
1189 fclose(f);
1190 if (keys_ref) {
1191 free(keys_ref->filename);
1192 free(keys_ref->tlskeys);
1193 free(keys_ref);
1194 }
1195 return ERR_ALERT | ERR_FATAL;
1196
1197#else
1198 memprintf(err, "'%s' : TLS ticket callback extension not supported", args[cur_arg]);
1199 return ERR_ALERT | ERR_FATAL;
1200#endif /* SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB */
1201}
1202
1203/* parse the "verify" bind keyword */
1204static int ssl_bind_parse_verify(char **args, int cur_arg, struct proxy *px, struct ssl_bind_conf *conf, char **err)
1205{
1206 if (!*args[cur_arg + 1]) {
1207 memprintf(err, "'%s' : missing verify method", args[cur_arg]);
1208 return ERR_ALERT | ERR_FATAL;
1209 }
1210
1211 if (strcmp(args[cur_arg + 1], "none") == 0)
1212 conf->verify = SSL_SOCK_VERIFY_NONE;
1213 else if (strcmp(args[cur_arg + 1], "optional") == 0)
1214 conf->verify = SSL_SOCK_VERIFY_OPTIONAL;
1215 else if (strcmp(args[cur_arg + 1], "required") == 0)
1216 conf->verify = SSL_SOCK_VERIFY_REQUIRED;
1217 else {
1218 memprintf(err, "'%s' : unknown verify method '%s', only 'none', 'optional', and 'required' are supported\n",
1219 args[cur_arg], args[cur_arg + 1]);
1220 return ERR_ALERT | ERR_FATAL;
1221 }
1222
1223 return 0;
1224}
1225static int bind_parse_verify(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
1226{
1227 return ssl_bind_parse_verify(args, cur_arg, px, &conf->ssl_conf, err);
1228}
1229
1230/* parse the "no-ca-names" bind keyword */
1231static int ssl_bind_parse_no_ca_names(char **args, int cur_arg, struct proxy *px, struct ssl_bind_conf *conf, char **err)
1232{
1233 conf->no_ca_names = 1;
1234 return 0;
1235}
1236static int bind_parse_no_ca_names(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
1237{
1238 return ssl_bind_parse_no_ca_names(args, cur_arg, px, &conf->ssl_conf, err);
1239}
1240
1241/***************************** "server" keywords Parsing ********************************************/
1242
1243/* parse the "npn" bind keyword */
1244static int srv_parse_npn(char **args, int *cur_arg, struct proxy *px, struct server *newsrv, char **err)
1245{
1246#if defined(OPENSSL_NPN_NEGOTIATED) && !defined(OPENSSL_NO_NEXTPROTONEG)
1247 char *p1, *p2;
1248
1249 if (!*args[*cur_arg + 1]) {
1250 memprintf(err, "'%s' : missing the comma-delimited NPN protocol suite", args[*cur_arg]);
1251 return ERR_ALERT | ERR_FATAL;
1252 }
1253
1254 free(newsrv->ssl_ctx.npn_str);
1255
1256 /* the NPN string is built as a suite of (<len> <name>)*,
1257 * so we reuse each comma to store the next <len> and need
1258 * one more for the end of the string.
1259 */
1260 newsrv->ssl_ctx.npn_len = strlen(args[*cur_arg + 1]) + 1;
1261 newsrv->ssl_ctx.npn_str = calloc(1, newsrv->ssl_ctx.npn_len + 1);
1262 memcpy(newsrv->ssl_ctx.npn_str + 1, args[*cur_arg + 1],
1263 newsrv->ssl_ctx.npn_len);
1264
1265 /* replace commas with the name length */
1266 p1 = newsrv->ssl_ctx.npn_str;
1267 p2 = p1 + 1;
1268 while (1) {
1269 p2 = memchr(p1 + 1, ',', newsrv->ssl_ctx.npn_str +
1270 newsrv->ssl_ctx.npn_len - (p1 + 1));
1271 if (!p2)
1272 p2 = p1 + 1 + strlen(p1 + 1);
1273
1274 if (p2 - (p1 + 1) > 255) {
1275 *p2 = '\0';
1276 memprintf(err, "'%s' : NPN protocol name too long : '%s'", args[*cur_arg], p1 + 1);
1277 return ERR_ALERT | ERR_FATAL;
1278 }
1279
1280 *p1 = p2 - (p1 + 1);
1281 p1 = p2;
1282
1283 if (!*p2)
1284 break;
1285
1286 *(p2++) = '\0';
1287 }
1288 return 0;
1289#else
1290 memprintf(err, "'%s' : library does not support TLS NPN extension", args[*cur_arg]);
1291 return ERR_ALERT | ERR_FATAL;
1292#endif
1293}
1294
1295/* parse the "alpn" or the "check-alpn" server keyword */
1296static int srv_parse_alpn(char **args, int *cur_arg, struct proxy *px, struct server *newsrv, char **err)
1297{
1298#ifdef TLSEXT_TYPE_application_layer_protocol_negotiation
1299 char **alpn_str;
1300 int *alpn_len;
1301 int ret;
1302
1303 if (*args[*cur_arg] == 'c') {
1304 alpn_str = &newsrv->check.alpn_str;
1305 alpn_len = &newsrv->check.alpn_len;
1306 } else {
1307 alpn_str = &newsrv->ssl_ctx.alpn_str;
1308 alpn_len = &newsrv->ssl_ctx.alpn_len;
1309
1310 }
1311
1312 free(*alpn_str);
1313 ret = ssl_sock_parse_alpn(args[*cur_arg + 1], alpn_str, alpn_len, err);
1314 if (ret)
1315 memprintf(err, "'%s' : %s", args[*cur_arg], *err);
1316 return ret;
1317#else
1318 memprintf(err, "'%s' : library does not support TLS ALPN extension", args[*cur_arg]);
1319 return ERR_ALERT | ERR_FATAL;
1320#endif
1321}
1322
1323/* parse the "ca-file" server keyword */
1324static int srv_parse_ca_file(char **args, int *cur_arg, struct proxy *px, struct server *newsrv, char **err)
1325{
1326 if (!*args[*cur_arg + 1]) {
1327 memprintf(err, "'%s' : missing CAfile path", args[*cur_arg]);
1328 return ERR_ALERT | ERR_FATAL;
1329 }
1330
1331 if ((*args[*cur_arg + 1] != '/') && global_ssl.ca_base)
1332 memprintf(&newsrv->ssl_ctx.ca_file, "%s/%s", global_ssl.ca_base, args[*cur_arg + 1]);
1333 else
1334 memprintf(&newsrv->ssl_ctx.ca_file, "%s", args[*cur_arg + 1]);
1335
1336 if (!ssl_store_load_locations_file(newsrv->ssl_ctx.ca_file)) {
1337 memprintf(err, "'%s' : unable to load %s", args[*cur_arg], newsrv->ssl_ctx.ca_file);
1338 return ERR_ALERT | ERR_FATAL;
1339 }
1340 return 0;
1341}
1342
1343/* parse the "check-sni" server keyword */
1344static int srv_parse_check_sni(char **args, int *cur_arg, struct proxy *px, struct server *newsrv, char **err)
1345{
1346 if (!*args[*cur_arg + 1]) {
1347 memprintf(err, "'%s' : missing SNI", args[*cur_arg]);
1348 return ERR_ALERT | ERR_FATAL;
1349 }
1350
1351 newsrv->check.sni = strdup(args[*cur_arg + 1]);
1352 if (!newsrv->check.sni) {
1353 memprintf(err, "'%s' : failed to allocate memory", args[*cur_arg]);
1354 return ERR_ALERT | ERR_FATAL;
1355 }
1356 return 0;
1357
1358}
1359
William Dauchyfc52f522020-11-14 19:25:32 +01001360/* common function to init ssl_ctx */
1361static void ssl_sock_init_srv(struct server *s)
William Lallemanddad31052020-05-14 17:47:32 +02001362{
William Dauchyfc52f522020-11-14 19:25:32 +01001363 if (global_ssl.connect_default_ciphers && !s->ssl_ctx.ciphers)
1364 s->ssl_ctx.ciphers = strdup(global_ssl.connect_default_ciphers);
Ilya Shipitsinf34ed0b2020-11-21 14:37:34 +05001365#ifdef HAVE_SSL_CTX_SET_CIPHERSUITES
William Dauchyfc52f522020-11-14 19:25:32 +01001366 if (global_ssl.connect_default_ciphersuites && !s->ssl_ctx.ciphersuites)
1367 s->ssl_ctx.ciphersuites = strdup(global_ssl.connect_default_ciphersuites);
William Lallemanddad31052020-05-14 17:47:32 +02001368#endif
William Dauchyfc52f522020-11-14 19:25:32 +01001369 s->ssl_ctx.options |= global_ssl.connect_default_ssloptions;
1370 s->ssl_ctx.methods.flags |= global_ssl.connect_default_sslmethods.flags;
1371
1372 if (!s->ssl_ctx.methods.min)
1373 s->ssl_ctx.methods.min = global_ssl.connect_default_sslmethods.min;
William Lallemanddad31052020-05-14 17:47:32 +02001374
William Dauchyfc52f522020-11-14 19:25:32 +01001375 if (!s->ssl_ctx.methods.max)
1376 s->ssl_ctx.methods.max = global_ssl.connect_default_sslmethods.max;
1377}
1378
1379/* parse the "check-ssl" server keyword */
1380static int srv_parse_check_ssl(char **args, int *cur_arg, struct proxy *px, struct server *newsrv, char **err)
1381{
1382 newsrv->check.use_ssl = 1;
1383 ssl_sock_init_srv(newsrv);
William Lallemanddad31052020-05-14 17:47:32 +02001384 return 0;
1385}
1386
1387/* parse the "ciphers" server keyword */
1388static int srv_parse_ciphers(char **args, int *cur_arg, struct proxy *px, struct server *newsrv, char **err)
1389{
1390 if (!*args[*cur_arg + 1]) {
1391 memprintf(err, "'%s' : missing cipher suite", args[*cur_arg]);
1392 return ERR_ALERT | ERR_FATAL;
1393 }
1394
1395 free(newsrv->ssl_ctx.ciphers);
1396 newsrv->ssl_ctx.ciphers = strdup(args[*cur_arg + 1]);
1397 return 0;
1398}
1399
Ilya Shipitsinf34ed0b2020-11-21 14:37:34 +05001400#ifdef HAVE_SSL_CTX_SET_CIPHERSUITES
William Lallemanddad31052020-05-14 17:47:32 +02001401/* parse the "ciphersuites" server keyword */
1402static int srv_parse_ciphersuites(char **args, int *cur_arg, struct proxy *px, struct server *newsrv, char **err)
1403{
1404 if (!*args[*cur_arg + 1]) {
1405 memprintf(err, "'%s' : missing cipher suite", args[*cur_arg]);
1406 return ERR_ALERT | ERR_FATAL;
1407 }
1408
1409 free(newsrv->ssl_ctx.ciphersuites);
1410 newsrv->ssl_ctx.ciphersuites = strdup(args[*cur_arg + 1]);
1411 return 0;
1412}
1413#endif
1414
1415/* parse the "crl-file" server keyword */
1416static int srv_parse_crl_file(char **args, int *cur_arg, struct proxy *px, struct server *newsrv, char **err)
1417{
1418#ifndef X509_V_FLAG_CRL_CHECK
1419 memprintf(err, "'%s' : library does not support CRL verify", args[*cur_arg]);
1420 return ERR_ALERT | ERR_FATAL;
1421#else
1422 if (!*args[*cur_arg + 1]) {
1423 memprintf(err, "'%s' : missing CRLfile path", args[*cur_arg]);
1424 return ERR_ALERT | ERR_FATAL;
1425 }
1426
1427 if ((*args[*cur_arg + 1] != '/') && global_ssl.ca_base)
1428 memprintf(&newsrv->ssl_ctx.crl_file, "%s/%s", global_ssl.ca_base, args[*cur_arg + 1]);
1429 else
1430 memprintf(&newsrv->ssl_ctx.crl_file, "%s", args[*cur_arg + 1]);
1431
1432 if (!ssl_store_load_locations_file(newsrv->ssl_ctx.crl_file)) {
1433 memprintf(err, "'%s' : unable to load %s", args[*cur_arg], newsrv->ssl_ctx.crl_file);
1434 return ERR_ALERT | ERR_FATAL;
1435 }
1436 return 0;
1437#endif
1438}
1439
1440/* parse the "crt" server keyword */
1441static int srv_parse_crt(char **args, int *cur_arg, struct proxy *px, struct server *newsrv, char **err)
1442{
1443 if (!*args[*cur_arg + 1]) {
1444 memprintf(err, "'%s' : missing certificate file path", args[*cur_arg]);
1445 return ERR_ALERT | ERR_FATAL;
1446 }
1447
1448 if ((*args[*cur_arg + 1] != '/') && global_ssl.crt_base)
1449 memprintf(&newsrv->ssl_ctx.client_crt, "%s/%s", global_ssl.crt_base, args[*cur_arg + 1]);
1450 else
1451 memprintf(&newsrv->ssl_ctx.client_crt, "%s", args[*cur_arg + 1]);
1452
1453 return 0;
1454}
1455
1456/* parse the "no-check-ssl" server keyword */
1457static int srv_parse_no_check_ssl(char **args, int *cur_arg, struct proxy *px, struct server *newsrv, char **err)
1458{
1459 newsrv->check.use_ssl = -1;
1460 free(newsrv->ssl_ctx.ciphers);
1461 newsrv->ssl_ctx.ciphers = NULL;
1462 newsrv->ssl_ctx.options &= ~global_ssl.connect_default_ssloptions;
1463 return 0;
1464}
1465
1466/* parse the "no-send-proxy-v2-ssl" server keyword */
1467static int srv_parse_no_send_proxy_ssl(char **args, int *cur_arg, struct proxy *px, struct server *newsrv, char **err)
1468{
1469 newsrv->pp_opts &= ~SRV_PP_V2;
1470 newsrv->pp_opts &= ~SRV_PP_V2_SSL;
1471 return 0;
1472}
1473
1474/* parse the "no-send-proxy-v2-ssl-cn" server keyword */
1475static int srv_parse_no_send_proxy_cn(char **args, int *cur_arg, struct proxy *px, struct server *newsrv, char **err)
1476{
1477 newsrv->pp_opts &= ~SRV_PP_V2;
1478 newsrv->pp_opts &= ~SRV_PP_V2_SSL;
1479 newsrv->pp_opts &= ~SRV_PP_V2_SSL_CN;
1480 return 0;
1481}
1482
1483/* parse the "no-ssl" server keyword */
1484static int srv_parse_no_ssl(char **args, int *cur_arg, struct proxy *px, struct server *newsrv, char **err)
1485{
William Dauchyf6370442020-11-14 19:25:33 +01001486 /* if default-server have use_ssl, prepare ssl settings */
1487 if (newsrv->use_ssl == 1)
1488 ssl_sock_init_srv(newsrv);
1489 else {
1490 free(newsrv->ssl_ctx.ciphers);
1491 newsrv->ssl_ctx.ciphers = NULL;
1492 }
William Lallemanddad31052020-05-14 17:47:32 +02001493 newsrv->use_ssl = -1;
William Lallemanddad31052020-05-14 17:47:32 +02001494 return 0;
1495}
1496
1497/* parse the "allow-0rtt" server keyword */
1498static int srv_parse_allow_0rtt(char **args, int *cur_arg, struct proxy *px, struct server *newsrv, char **err)
1499{
1500 newsrv->ssl_ctx.options |= SRV_SSL_O_EARLY_DATA;
1501 return 0;
1502}
1503
1504/* parse the "no-ssl-reuse" server keyword */
1505static int srv_parse_no_ssl_reuse(char **args, int *cur_arg, struct proxy *px, struct server *newsrv, char **err)
1506{
1507 newsrv->ssl_ctx.options |= SRV_SSL_O_NO_REUSE;
1508 return 0;
1509}
1510
1511/* parse the "no-tls-tickets" server keyword */
1512static int srv_parse_no_tls_tickets(char **args, int *cur_arg, struct proxy *px, struct server *newsrv, char **err)
1513{
1514 newsrv->ssl_ctx.options |= SRV_SSL_O_NO_TLS_TICKETS;
1515 return 0;
1516}
1517/* parse the "send-proxy-v2-ssl" server keyword */
1518static int srv_parse_send_proxy_ssl(char **args, int *cur_arg, struct proxy *px, struct server *newsrv, char **err)
1519{
1520 newsrv->pp_opts |= SRV_PP_V2;
1521 newsrv->pp_opts |= SRV_PP_V2_SSL;
1522 return 0;
1523}
1524
1525/* parse the "send-proxy-v2-ssl-cn" server keyword */
1526static int srv_parse_send_proxy_cn(char **args, int *cur_arg, struct proxy *px, struct server *newsrv, char **err)
1527{
1528 newsrv->pp_opts |= SRV_PP_V2;
1529 newsrv->pp_opts |= SRV_PP_V2_SSL;
1530 newsrv->pp_opts |= SRV_PP_V2_SSL_CN;
1531 return 0;
1532}
1533
1534/* parse the "sni" server keyword */
1535static int srv_parse_sni(char **args, int *cur_arg, struct proxy *px, struct server *newsrv, char **err)
1536{
1537#ifndef SSL_CTRL_SET_TLSEXT_HOSTNAME
1538 memprintf(err, "'%s' : the current SSL library doesn't support the SNI TLS extension", args[*cur_arg]);
1539 return ERR_ALERT | ERR_FATAL;
1540#else
1541 char *arg;
1542
1543 arg = args[*cur_arg + 1];
1544 if (!*arg) {
1545 memprintf(err, "'%s' : missing sni expression", args[*cur_arg]);
1546 return ERR_ALERT | ERR_FATAL;
1547 }
1548
1549 free(newsrv->sni_expr);
1550 newsrv->sni_expr = strdup(arg);
1551
1552 return 0;
1553#endif
1554}
1555
1556/* parse the "ssl" server keyword */
1557static int srv_parse_ssl(char **args, int *cur_arg, struct proxy *px, struct server *newsrv, char **err)
1558{
1559 newsrv->use_ssl = 1;
William Dauchyfc52f522020-11-14 19:25:32 +01001560 ssl_sock_init_srv(newsrv);
William Lallemanddad31052020-05-14 17:47:32 +02001561 return 0;
1562}
1563
1564/* parse the "ssl-reuse" server keyword */
1565static int srv_parse_ssl_reuse(char **args, int *cur_arg, struct proxy *px, struct server *newsrv, char **err)
1566{
1567 newsrv->ssl_ctx.options &= ~SRV_SSL_O_NO_REUSE;
1568 return 0;
1569}
1570
1571/* parse the "tls-tickets" server keyword */
1572static int srv_parse_tls_tickets(char **args, int *cur_arg, struct proxy *px, struct server *newsrv, char **err)
1573{
1574 newsrv->ssl_ctx.options &= ~SRV_SSL_O_NO_TLS_TICKETS;
1575 return 0;
1576}
1577
1578/* parse the "verify" server keyword */
1579static int srv_parse_verify(char **args, int *cur_arg, struct proxy *px, struct server *newsrv, char **err)
1580{
1581 if (!*args[*cur_arg + 1]) {
1582 memprintf(err, "'%s' : missing verify method", args[*cur_arg]);
1583 return ERR_ALERT | ERR_FATAL;
1584 }
1585
1586 if (strcmp(args[*cur_arg + 1], "none") == 0)
1587 newsrv->ssl_ctx.verify = SSL_SOCK_VERIFY_NONE;
1588 else if (strcmp(args[*cur_arg + 1], "required") == 0)
1589 newsrv->ssl_ctx.verify = SSL_SOCK_VERIFY_REQUIRED;
1590 else {
1591 memprintf(err, "'%s' : unknown verify method '%s', only 'none' and 'required' are supported\n",
1592 args[*cur_arg], args[*cur_arg + 1]);
1593 return ERR_ALERT | ERR_FATAL;
1594 }
1595
1596 return 0;
1597}
1598
1599/* parse the "verifyhost" server keyword */
1600static int srv_parse_verifyhost(char **args, int *cur_arg, struct proxy *px, struct server *newsrv, char **err)
1601{
1602 if (!*args[*cur_arg + 1]) {
1603 memprintf(err, "'%s' : missing hostname to verify against", args[*cur_arg]);
1604 return ERR_ALERT | ERR_FATAL;
1605 }
1606
1607 free(newsrv->ssl_ctx.verify_host);
1608 newsrv->ssl_ctx.verify_host = strdup(args[*cur_arg + 1]);
1609
1610 return 0;
1611}
1612
1613/* parse the "ssl-default-bind-options" keyword in global section */
1614static int ssl_parse_default_bind_options(char **args, int section_type, struct proxy *curpx,
1615 struct proxy *defpx, const char *file, int line,
1616 char **err) {
1617 int i = 1;
1618
1619 if (*(args[i]) == 0) {
1620 memprintf(err, "global statement '%s' expects an option as an argument.", args[0]);
1621 return -1;
1622 }
1623 while (*(args[i])) {
1624 if (!strcmp(args[i], "no-tls-tickets"))
1625 global_ssl.listen_default_ssloptions |= BC_SSL_O_NO_TLS_TICKETS;
1626 else if (!strcmp(args[i], "prefer-client-ciphers"))
1627 global_ssl.listen_default_ssloptions |= BC_SSL_O_PREF_CLIE_CIPH;
1628 else if (!strcmp(args[i], "ssl-min-ver") || !strcmp(args[i], "ssl-max-ver")) {
1629 if (!parse_tls_method_minmax(args, i, &global_ssl.listen_default_sslmethods, err))
1630 i++;
1631 else {
1632 memprintf(err, "%s on global statement '%s'.", *err, args[0]);
1633 return -1;
1634 }
1635 }
1636 else if (parse_tls_method_options(args[i], &global_ssl.listen_default_sslmethods, err)) {
1637 memprintf(err, "unknown option '%s' on global statement '%s'.", args[i], args[0]);
1638 return -1;
1639 }
1640 i++;
1641 }
1642 return 0;
1643}
1644
1645/* parse the "ssl-default-server-options" keyword in global section */
1646static int ssl_parse_default_server_options(char **args, int section_type, struct proxy *curpx,
1647 struct proxy *defpx, const char *file, int line,
1648 char **err) {
1649 int i = 1;
1650
1651 if (*(args[i]) == 0) {
1652 memprintf(err, "global statement '%s' expects an option as an argument.", args[0]);
1653 return -1;
1654 }
1655 while (*(args[i])) {
1656 if (!strcmp(args[i], "no-tls-tickets"))
1657 global_ssl.connect_default_ssloptions |= SRV_SSL_O_NO_TLS_TICKETS;
1658 else if (!strcmp(args[i], "ssl-min-ver") || !strcmp(args[i], "ssl-max-ver")) {
1659 if (!parse_tls_method_minmax(args, i, &global_ssl.connect_default_sslmethods, err))
1660 i++;
1661 else {
1662 memprintf(err, "%s on global statement '%s'.", *err, args[0]);
1663 return -1;
1664 }
1665 }
1666 else if (parse_tls_method_options(args[i], &global_ssl.connect_default_sslmethods, err)) {
1667 memprintf(err, "unknown option '%s' on global statement '%s'.", args[i], args[0]);
1668 return -1;
1669 }
1670 i++;
1671 }
1672 return 0;
1673}
1674
1675/* parse the "ca-base" / "crt-base" keywords in global section.
1676 * Returns <0 on alert, >0 on warning, 0 on success.
1677 */
1678static int ssl_parse_global_ca_crt_base(char **args, int section_type, struct proxy *curpx,
1679 struct proxy *defpx, const char *file, int line,
1680 char **err)
1681{
1682 char **target;
1683
1684 target = (args[0][1] == 'a') ? &global_ssl.ca_base : &global_ssl.crt_base;
1685
1686 if (too_many_args(1, args, err, NULL))
1687 return -1;
1688
1689 if (*target) {
1690 memprintf(err, "'%s' already specified.", args[0]);
1691 return -1;
1692 }
1693
1694 if (*(args[1]) == 0) {
1695 memprintf(err, "global statement '%s' expects a directory path as an argument.", args[0]);
1696 return -1;
1697 }
1698 *target = strdup(args[1]);
1699 return 0;
1700}
1701
1702/* parse the "ssl-skip-self-issued-ca" keyword in global section. */
1703static int ssl_parse_skip_self_issued_ca(char **args, int section_type, struct proxy *curpx,
1704 struct proxy *defpx, const char *file, int line,
1705 char **err)
1706{
William Lallemand9a1d8392020-08-10 17:28:23 +02001707#ifdef SSL_CTX_build_cert_chain
William Lallemanddad31052020-05-14 17:47:32 +02001708 global_ssl.skip_self_issued_ca = 1;
1709 return 0;
William Lallemand9a1d8392020-08-10 17:28:23 +02001710#else
1711 memprintf(err, "global statement '%s' requires at least OpenSSL 1.0.2.", args[0]);
1712 return -1;
1713#endif
William Lallemanddad31052020-05-14 17:47:32 +02001714}
1715
1716
1717
1718
1719
1720/* Note: must not be declared <const> as its list will be overwritten.
1721 * Please take care of keeping this list alphabetically sorted, doing so helps
1722 * all code contributors.
1723 * Optional keywords are also declared with a NULL ->parse() function so that
1724 * the config parser can report an appropriate error when a known keyword was
1725 * not enabled.
1726 */
1727
1728/* the <ssl_bind_kws> keywords are used for crt-list parsing, they *MUST* be safe
1729 * with their proxy argument NULL and must only fill the ssl_bind_conf */
1730struct ssl_bind_kw ssl_bind_kws[] = {
1731 { "allow-0rtt", ssl_bind_parse_allow_0rtt, 0 }, /* allow 0-RTT */
1732 { "alpn", ssl_bind_parse_alpn, 1 }, /* set ALPN supported protocols */
1733 { "ca-file", ssl_bind_parse_ca_file, 1 }, /* set CAfile to process ca-names and verify on client cert */
1734 { "ca-verify-file", ssl_bind_parse_ca_verify_file, 1 }, /* set CAverify file to process verify on client cert */
1735 { "ciphers", ssl_bind_parse_ciphers, 1 }, /* set SSL cipher suite */
Ilya Shipitsinf34ed0b2020-11-21 14:37:34 +05001736#ifdef HAVE_SSL_CTX_SET_CIPHERSUITES
William Lallemanddad31052020-05-14 17:47:32 +02001737 { "ciphersuites", ssl_bind_parse_ciphersuites, 1 }, /* set TLS 1.3 cipher suite */
1738#endif
1739 { "crl-file", ssl_bind_parse_crl_file, 1 }, /* set certificate revocation list file use on client cert verify */
1740 { "curves", ssl_bind_parse_curves, 1 }, /* set SSL curve suite */
1741 { "ecdhe", ssl_bind_parse_ecdhe, 1 }, /* defines named curve for elliptic curve Diffie-Hellman */
1742 { "no-ca-names", ssl_bind_parse_no_ca_names, 0 }, /* do not send ca names to clients (ca_file related) */
1743 { "npn", ssl_bind_parse_npn, 1 }, /* set NPN supported protocols */
1744 { "ssl-min-ver", ssl_bind_parse_tls_method_minmax,1 }, /* minimum version */
1745 { "ssl-max-ver", ssl_bind_parse_tls_method_minmax,1 }, /* maximum version */
1746 { "verify", ssl_bind_parse_verify, 1 }, /* set SSL verify method */
1747 { NULL, NULL, 0 },
1748};
1749
1750/* no initcall for ssl_bind_kws, these ones are parsed in the parser loop */
1751
1752static struct bind_kw_list bind_kws = { "SSL", { }, {
1753 { "allow-0rtt", bind_parse_allow_0rtt, 0 }, /* Allow 0RTT */
1754 { "alpn", bind_parse_alpn, 1 }, /* set ALPN supported protocols */
1755 { "ca-file", bind_parse_ca_file, 1 }, /* set CAfile to process ca-names and verify on client cert */
1756 { "ca-verify-file", bind_parse_ca_verify_file, 1 }, /* set CAverify file to process verify on client cert */
1757 { "ca-ignore-err", bind_parse_ignore_err, 1 }, /* set error IDs to ignore on verify depth > 0 */
1758 { "ca-sign-file", bind_parse_ca_sign_file, 1 }, /* set CAFile used to generate and sign server certs */
1759 { "ca-sign-pass", bind_parse_ca_sign_pass, 1 }, /* set CAKey passphrase */
1760 { "ciphers", bind_parse_ciphers, 1 }, /* set SSL cipher suite */
Ilya Shipitsinf34ed0b2020-11-21 14:37:34 +05001761#ifdef HAVE_SSL_CTX_SET_CIPHERSUITES
William Lallemanddad31052020-05-14 17:47:32 +02001762 { "ciphersuites", bind_parse_ciphersuites, 1 }, /* set TLS 1.3 cipher suite */
1763#endif
1764 { "crl-file", bind_parse_crl_file, 1 }, /* set certificate revocation list file use on client cert verify */
1765 { "crt", bind_parse_crt, 1 }, /* load SSL certificates from this location */
1766 { "crt-ignore-err", bind_parse_ignore_err, 1 }, /* set error IDs to ignore on verify depth == 0 */
1767 { "crt-list", bind_parse_crt_list, 1 }, /* load a list of crt from this location */
1768 { "curves", bind_parse_curves, 1 }, /* set SSL curve suite */
1769 { "ecdhe", bind_parse_ecdhe, 1 }, /* defines named curve for elliptic curve Diffie-Hellman */
1770 { "force-sslv3", bind_parse_tls_method_options, 0 }, /* force SSLv3 */
1771 { "force-tlsv10", bind_parse_tls_method_options, 0 }, /* force TLSv10 */
1772 { "force-tlsv11", bind_parse_tls_method_options, 0 }, /* force TLSv11 */
1773 { "force-tlsv12", bind_parse_tls_method_options, 0 }, /* force TLSv12 */
1774 { "force-tlsv13", bind_parse_tls_method_options, 0 }, /* force TLSv13 */
1775 { "generate-certificates", bind_parse_generate_certs, 0 }, /* enable the server certificates generation */
1776 { "no-ca-names", bind_parse_no_ca_names, 0 }, /* do not send ca names to clients (ca_file related) */
1777 { "no-sslv3", bind_parse_tls_method_options, 0 }, /* disable SSLv3 */
1778 { "no-tlsv10", bind_parse_tls_method_options, 0 }, /* disable TLSv10 */
1779 { "no-tlsv11", bind_parse_tls_method_options, 0 }, /* disable TLSv11 */
1780 { "no-tlsv12", bind_parse_tls_method_options, 0 }, /* disable TLSv12 */
1781 { "no-tlsv13", bind_parse_tls_method_options, 0 }, /* disable TLSv13 */
1782 { "no-tls-tickets", bind_parse_no_tls_tickets, 0 }, /* disable session resumption tickets */
1783 { "ssl", bind_parse_ssl, 0 }, /* enable SSL processing */
1784 { "ssl-min-ver", bind_parse_tls_method_minmax, 1 }, /* minimum version */
1785 { "ssl-max-ver", bind_parse_tls_method_minmax, 1 }, /* maximum version */
1786 { "strict-sni", bind_parse_strict_sni, 0 }, /* refuse negotiation if sni doesn't match a certificate */
1787 { "tls-ticket-keys", bind_parse_tls_ticket_keys, 1 }, /* set file to load TLS ticket keys from */
1788 { "verify", bind_parse_verify, 1 }, /* set SSL verify method */
1789 { "npn", bind_parse_npn, 1 }, /* set NPN supported protocols */
1790 { "prefer-client-ciphers", bind_parse_pcc, 0 }, /* prefer client ciphers */
1791 { NULL, NULL, 0 },
1792}};
1793
1794INITCALL1(STG_REGISTER, bind_register_keywords, &bind_kws);
1795
1796/* Note: must not be declared <const> as its list will be overwritten.
1797 * Please take care of keeping this list alphabetically sorted, doing so helps
1798 * all code contributors.
1799 * Optional keywords are also declared with a NULL ->parse() function so that
1800 * the config parser can report an appropriate error when a known keyword was
1801 * not enabled.
1802 */
1803static struct srv_kw_list srv_kws = { "SSL", { }, {
1804 { "allow-0rtt", srv_parse_allow_0rtt, 0, 1 }, /* Allow using early data on this server */
1805 { "alpn", srv_parse_alpn, 1, 1 }, /* Set ALPN supported protocols */
1806 { "ca-file", srv_parse_ca_file, 1, 1 }, /* set CAfile to process verify server cert */
1807 { "check-alpn", srv_parse_alpn, 1, 1 }, /* Set ALPN used for checks */
1808 { "check-sni", srv_parse_check_sni, 1, 1 }, /* set SNI */
1809 { "check-ssl", srv_parse_check_ssl, 0, 1 }, /* enable SSL for health checks */
1810 { "ciphers", srv_parse_ciphers, 1, 1 }, /* select the cipher suite */
Ilya Shipitsinf34ed0b2020-11-21 14:37:34 +05001811#ifdef HAVE_SSL_CTX_SET_CIPHERSUITES
William Lallemanddad31052020-05-14 17:47:32 +02001812 { "ciphersuites", srv_parse_ciphersuites, 1, 1 }, /* select the cipher suite */
1813#endif
1814 { "crl-file", srv_parse_crl_file, 1, 1 }, /* set certificate revocation list file use on server cert verify */
1815 { "crt", srv_parse_crt, 1, 1 }, /* set client certificate */
1816 { "force-sslv3", srv_parse_tls_method_options, 0, 1 }, /* force SSLv3 */
1817 { "force-tlsv10", srv_parse_tls_method_options, 0, 1 }, /* force TLSv10 */
1818 { "force-tlsv11", srv_parse_tls_method_options, 0, 1 }, /* force TLSv11 */
1819 { "force-tlsv12", srv_parse_tls_method_options, 0, 1 }, /* force TLSv12 */
1820 { "force-tlsv13", srv_parse_tls_method_options, 0, 1 }, /* force TLSv13 */
1821 { "no-check-ssl", srv_parse_no_check_ssl, 0, 1 }, /* disable SSL for health checks */
1822 { "no-send-proxy-v2-ssl", srv_parse_no_send_proxy_ssl, 0, 1 }, /* do not send PROXY protocol header v2 with SSL info */
1823 { "no-send-proxy-v2-ssl-cn", srv_parse_no_send_proxy_cn, 0, 1 }, /* do not send PROXY protocol header v2 with CN */
1824 { "no-ssl", srv_parse_no_ssl, 0, 1 }, /* disable SSL processing */
1825 { "no-ssl-reuse", srv_parse_no_ssl_reuse, 0, 1 }, /* disable session reuse */
1826 { "no-sslv3", srv_parse_tls_method_options, 0, 0 }, /* disable SSLv3 */
1827 { "no-tlsv10", srv_parse_tls_method_options, 0, 0 }, /* disable TLSv10 */
1828 { "no-tlsv11", srv_parse_tls_method_options, 0, 0 }, /* disable TLSv11 */
1829 { "no-tlsv12", srv_parse_tls_method_options, 0, 0 }, /* disable TLSv12 */
1830 { "no-tlsv13", srv_parse_tls_method_options, 0, 0 }, /* disable TLSv13 */
1831 { "no-tls-tickets", srv_parse_no_tls_tickets, 0, 1 }, /* disable session resumption tickets */
1832 { "npn", srv_parse_npn, 1, 1 }, /* Set NPN supported protocols */
1833 { "send-proxy-v2-ssl", srv_parse_send_proxy_ssl, 0, 1 }, /* send PROXY protocol header v2 with SSL info */
1834 { "send-proxy-v2-ssl-cn", srv_parse_send_proxy_cn, 0, 1 }, /* send PROXY protocol header v2 with CN */
1835 { "sni", srv_parse_sni, 1, 1 }, /* send SNI extension */
1836 { "ssl", srv_parse_ssl, 0, 1 }, /* enable SSL processing */
1837 { "ssl-min-ver", srv_parse_tls_method_minmax, 1, 1 }, /* minimum version */
1838 { "ssl-max-ver", srv_parse_tls_method_minmax, 1, 1 }, /* maximum version */
1839 { "ssl-reuse", srv_parse_ssl_reuse, 0, 1 }, /* enable session reuse */
1840 { "tls-tickets", srv_parse_tls_tickets, 0, 1 }, /* enable session resumption tickets */
1841 { "verify", srv_parse_verify, 1, 1 }, /* set SSL verify method */
1842 { "verifyhost", srv_parse_verifyhost, 1, 1 }, /* require that SSL cert verifies for hostname */
1843 { NULL, NULL, 0, 0 },
1844}};
1845
1846INITCALL1(STG_REGISTER, srv_register_keywords, &srv_kws);
1847
1848static struct cfg_kw_list cfg_kws = {ILH, {
1849 { CFG_GLOBAL, "ca-base", ssl_parse_global_ca_crt_base },
1850 { CFG_GLOBAL, "crt-base", ssl_parse_global_ca_crt_base },
1851 { CFG_GLOBAL, "issuers-chain-path", ssl_load_global_issuers_from_path },
1852 { CFG_GLOBAL, "maxsslconn", ssl_parse_global_int },
1853 { CFG_GLOBAL, "ssl-default-bind-options", ssl_parse_default_bind_options },
1854 { CFG_GLOBAL, "ssl-default-server-options", ssl_parse_default_server_options },
1855#ifndef OPENSSL_NO_DH
1856 { CFG_GLOBAL, "ssl-dh-param-file", ssl_parse_global_dh_param_file },
1857#endif
1858 { CFG_GLOBAL, "ssl-mode-async", ssl_parse_global_ssl_async },
1859#ifndef OPENSSL_NO_ENGINE
1860 { CFG_GLOBAL, "ssl-engine", ssl_parse_global_ssl_engine },
1861#endif
1862 { CFG_GLOBAL, "ssl-skip-self-issued-ca", ssl_parse_skip_self_issued_ca },
1863 { CFG_GLOBAL, "tune.ssl.cachesize", ssl_parse_global_int },
1864#ifndef OPENSSL_NO_DH
1865 { CFG_GLOBAL, "tune.ssl.default-dh-param", ssl_parse_global_default_dh },
1866#endif
1867 { CFG_GLOBAL, "tune.ssl.force-private-cache", ssl_parse_global_private_cache },
1868 { CFG_GLOBAL, "tune.ssl.lifetime", ssl_parse_global_lifetime },
1869 { CFG_GLOBAL, "tune.ssl.maxrecord", ssl_parse_global_int },
1870 { CFG_GLOBAL, "tune.ssl.ssl-ctx-cache-size", ssl_parse_global_int },
1871 { CFG_GLOBAL, "tune.ssl.capture-cipherlist-size", ssl_parse_global_capture_cipherlist },
Ilya Shipitsin04a5a442020-11-03 14:15:38 +05001872#ifdef HAVE_OPENSSL_KEYLOG
William Lallemand7d42ef52020-07-06 11:41:30 +02001873 { CFG_GLOBAL, "tune.ssl.keylog", ssl_parse_global_keylog },
1874#endif
William Lallemanddad31052020-05-14 17:47:32 +02001875 { CFG_GLOBAL, "ssl-default-bind-ciphers", ssl_parse_global_ciphers },
1876 { CFG_GLOBAL, "ssl-default-server-ciphers", ssl_parse_global_ciphers },
Ilya Shipitsin0aa8c292020-11-04 00:39:07 +05001877#if defined(SSL_CTX_set1_curves_list)
William Lallemanddad31052020-05-14 17:47:32 +02001878 { CFG_GLOBAL, "ssl-default-bind-curves", ssl_parse_global_curves },
1879#endif
Ilya Shipitsinf34ed0b2020-11-21 14:37:34 +05001880#ifdef HAVE_SSL_CTX_SET_CIPHERSUITES
William Lallemanddad31052020-05-14 17:47:32 +02001881 { CFG_GLOBAL, "ssl-default-bind-ciphersuites", ssl_parse_global_ciphersuites },
1882 { CFG_GLOBAL, "ssl-default-server-ciphersuites", ssl_parse_global_ciphersuites },
1883#endif
1884 { CFG_GLOBAL, "ssl-load-extra-files", ssl_parse_global_extra_files },
William Lallemand8e8581e2020-10-20 17:36:46 +02001885 { CFG_GLOBAL, "ssl-load-extra-del-ext", ssl_parse_global_extra_noext },
William Lallemanddad31052020-05-14 17:47:32 +02001886 { 0, NULL, NULL },
1887}};
1888
1889INITCALL1(STG_REGISTER, cfg_register_keywords, &cfg_kws);