dnsdist: Check that the TLS key type is supported

diff --git a/pdns/dnsdist-lua.cc b/pdns/dnsdist-lua.cc
index 4195d428ba70b6961e9fe2a228eef6ea5df471f4..62a23416677c4356188e41d6e5b2c8ebe7785690 100644 (file)
--- a/pdns/dnsdist-lua.cc
+++ b/pdns/dnsdist-lua.cc
@@ -87,7 +87,7 @@ void resetLuaSideEffect()
   g_noLuaSideEffect = boost::logic::indeterminate;
 }
 
-typedef std::unordered_map<std::string, boost::variant<bool, int, std::string, std::vector<std::pair<int,int> >, std::map<std::string,std::string>, std::vector<std::pair<int, std::string> > > > localbind_t;
+typedef std::unordered_map<std::string, boost::variant<bool, int, std::string, std::vector<std::pair<int,int> >, std::vector<std::pair<int, std::string> >, std::map<std::string,std::string>  > > localbind_t;
 
 static void parseLocalBindVars(boost::optional<localbind_t> vars, bool& reusePort, int& tcpFastOpenQueueSize, std::string& interface, std::set<int>& cpus)
 {

diff --git a/pdns/dnsdistdist/doh.cc b/pdns/dnsdistdist/doh.cc
index bb4b6da94fb8b1ff04eb46fc6f129b9d51198064..3074c8ed767057a7fd6b3ba539f45c9312609861 100644 (file)
--- a/pdns/dnsdistdist/doh.cc
+++ b/pdns/dnsdistdist/doh.cc
@@ -773,7 +773,11 @@ static std::unique_ptr<SSL_CTX, void(*)(SSL_CTX*)> getTLSContext(const std::vect
       throw std::runtime_error("Failed to setup SSL/TLS for DoH listener, the key from '" + pair.second + "' does not match the certificate from '" + pair.first + "'");
     }
     /* store the type of the new key, we might need it later to select the right OCSP stapling response */
-    keyTypes.push_back(libssl_get_last_key_type(ctx));
+    auto keyType = libssl_get_last_key_type(ctx);
+    if (keyType < 0) {
+      throw std::runtime_error("Failed to setup SSL/TLS for DoH listener, the key from '" + pair.second + "' has an unknown type");
+    }
+    keyTypes.push_back(keyType);
   }
 
   if (!ocspFiles.empty()) {

diff --git a/pdns/dnsdistdist/tcpiohandler.cc b/pdns/dnsdistdist/tcpiohandler.cc
index f14c6e8ddfecafbd4f09bc9ab88419c6c90ccb11..fab7815debae23ce193b09dbe62b55d8b1418a69 100644 (file)
--- a/pdns/dnsdistdist/tcpiohandler.cc
+++ b/pdns/dnsdistdist/tcpiohandler.cc
@@ -438,7 +438,11 @@ public:
       }
 
       /* store the type of the new key, we might need it later to select the right OCSP stapling response */
-      keyTypes.push_back(libssl_get_last_key_type(d_tlsCtx));
+      auto keyType = libssl_get_last_key_type(d_tlsCtx);
+      if (keyType < 0) {
+        throw std::runtime_error("Key from '" + pair.second + "' has an unknown type");
+      }
+      keyTypes.push_back(keyType);
     }
 
     if (!fe.d_ocspFiles.empty()) {