From: William Lallemand <wlallemand@haproxy.org>
Date: Tue, 5 Apr 2022 08:19:30 +0000 (+0200)
Subject: BUG/MINOR: ssl: handle X509_get_default_cert_dir() returning NULL
X-Git-Tag: v2.6-dev5~52
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=80296b4bd502764d00699f0ffe5f65658ffb7142;p=thirdparty%2Fhaproxy.git

BUG/MINOR: ssl: handle X509_get_default_cert_dir() returning NULL

ssl_store_load_locations_file() is using X509_get_default_cert_dir()
when using '@system-ca' as a parameter.

This function could return a NULL if OpenSSL was built with a
X509_CERT_DIR set to NULL, this is uncommon but let's fix this.

No backport needed, 2.6 only.

Fix issue #1637.
---

diff --git a/src/ssl_ckch.c b/src/ssl_ckch.c
index 438483c95b..c047b1c6b2 100644
--- a/src/ssl_ckch.c
+++ b/src/ssl_ckch.c
@@ -1124,7 +1124,7 @@ int ssl_store_load_locations_file(char *path, int create_if_none, enum cafile_ty
 			if (!X509_STORE_load_locations(store, file, NULL)) {
 				goto err;
 			}
-		} else {
+		} else if (dir) {
 			int n, i;
 			struct dirent **de_list;
 
@@ -1178,6 +1178,9 @@ scandir_err:
 
 			}
 			free(de_list);
+		} else {
+			ha_alert("ca-file: couldn't load '%s'\n", path);
+			goto err;
 		}
 
 		objs = X509_STORE_get0_objects(store);