]> git.ipfire.org Git - thirdparty/haproxy.git/commit
BUG/MEDIUM: ssl: first outgoing connection would fail with {ca,crt}-ignore-err
authorEmeric Brun <ebrun@exceliance.fr>
Mon, 3 Dec 2012 12:24:29 +0000 (13:24 +0100)
committerWilly Tarreau <w@1wt.eu>
Mon, 3 Dec 2012 18:39:40 +0000 (19:39 +0100)
commit1eb20efe701ef555efb430bf42d9c3064d2c3c7e
treef56ff833ed8a183c6aca2f131e1ea1030541bdd7
parent78617e51fd6a8972f13b080cfb116d22f25bcee8
BUG/MEDIUM: ssl: first outgoing connection would fail with {ca,crt}-ignore-err

When using ca_ignore_err/crt_ignore_err, a connection to an untrusted
server raises an error which is ignored. But the next SSL_read() that
encounters EAGAIN raises the error again, breaking the connection.

Subsequent connections don't have this problem because the session has
been stored and is correctly reused without performing a verify again.

The solution consists in correctly flushing the SSL error stack when
ignoring the crt/ca error.
src/ssl_sock.c