From: Jerome Magnin Date: Wed, 22 Apr 2020 09:40:18 +0000 (+0200) Subject: BUG/MINOR: ssl: default settings for ssl server options are not used X-Git-Tag: v2.2-dev7~198 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=2e8d52f869ed7673a8274ec7b045161e09350251;p=thirdparty%2Fhaproxy.git BUG/MINOR: ssl: default settings for ssl server options are not used Documentation states that default settings for ssl server options can be set using either ssl-default-server-options or default-server directives. In practice, not all ssl server options can have default values, such as ssl-min-ver, ssl-max-ver, etc.. This patch adds the missing ssl options in srv_ssl_settings_cpy() and srv_parse_ssl(), making it possible to write configurations like the following examples, and have them behave as expected. global ssl-default-server-options ssl-max-ver TLSv1.2 defaults mode http listen l1 bind 1.2.3.4:80 default-server ssl verify none server s1 1.2.3.5:443 listen l2 bind 2.2.3.4:80 default-server ssl verify none ssl-max-ver TLSv1.3 ssl-min-ver TLSv1.2 server s1 1.2.3.6:443 This should be backported as far as 1.8. This fixes issue #595. --- diff --git a/src/server.c b/src/server.c index 4c745d655d..f90cfff5a0 100644 --- a/src/server.c +++ b/src/server.c @@ -1643,6 +1643,15 @@ static void srv_ssl_settings_cpy(struct server *srv, struct server *src) srv->ssl_ctx.verify_host = strdup(src->ssl_ctx.verify_host); if (src->ssl_ctx.ciphers != NULL) srv->ssl_ctx.ciphers = strdup(src->ssl_ctx.ciphers); + if (src->ssl_ctx.options) + srv->ssl_ctx.options = src->ssl_ctx.options; + if (src->ssl_ctx.methods.flags) + srv->ssl_ctx.methods.flags = src->ssl_ctx.methods.flags; + if (src->ssl_ctx.methods.min) + srv->ssl_ctx.methods.min = src->ssl_ctx.methods.min; + if (src->ssl_ctx.methods.max) + srv->ssl_ctx.methods.max = src->ssl_ctx.methods.max; + #if (HA_OPENSSL_VERSION_NUMBER >= 0x10101000L && !defined OPENSSL_IS_BORINGSSL) if (src->ssl_ctx.ciphersuites != NULL) srv->ssl_ctx.ciphersuites = strdup(src->ssl_ctx.ciphersuites); diff --git a/src/ssl_sock.c b/src/ssl_sock.c index cbb7e2fa21..4374788192 100644 --- a/src/ssl_sock.c +++ b/src/ssl_sock.c @@ -10051,6 +10051,16 @@ static int srv_parse_ssl(char **args, int *cur_arg, struct proxy *px, struct ser if (global_ssl.connect_default_ciphersuites && !newsrv->ssl_ctx.ciphersuites) newsrv->ssl_ctx.ciphersuites = strdup(global_ssl.connect_default_ciphersuites); #endif + newsrv->ssl_ctx.options |= global_ssl.connect_default_ssloptions; + newsrv->ssl_ctx.methods.flags |= global_ssl.connect_default_sslmethods.flags; + + if (!newsrv->ssl_ctx.methods.min) + newsrv->ssl_ctx.methods.min = global_ssl.connect_default_sslmethods.min; + + if (!newsrv->ssl_ctx.methods.max) + newsrv->ssl_ctx.methods.max = global_ssl.connect_default_sslmethods.max; + + return 0; }