Cleanup: Expose SSL initialization function to libsecurity

SSL initialize needs to be performed before any security context
objects are generated. Expose the function so that the new blank
context methods can use it.

diff --git a/src/security/PeerOptions.cc b/src/security/PeerOptions.cc
index 9c2975a2d8b386d3cfeed35023cce4e2f9814111..0d3b51e2c9aa752c64cd1149fe5fdb71fb5db4c5 100644 (file)
--- a/src/security/PeerOptions.cc
+++ b/src/security/PeerOptions.cc
@@ -198,6 +198,8 @@ Security::PeerOptions::createBlankContext() const
     Security::ContextPtr t = nullptr;
 
 #if USE_OPENSSL
+    Ssl::Initialize();
+
 #if (OPENSSL_VERSION_NUMBER >= 0x10100000L)
     t = SSL_CTX_new(TLS_client_method());
 #else

diff --git a/src/security/ServerOptions.cc b/src/security/ServerOptions.cc
index f943011742555cca469c9935aa9166de5ab7cded..dd376de70cc0e5a5bfd40af0630ff40495a31539 100644 (file)
--- a/src/security/ServerOptions.cc
+++ b/src/security/ServerOptions.cc
@@ -10,6 +10,9 @@
 #include "base/Packable.h"
 #include "globals.h"
 #include "security/ServerOptions.h"
+#if USE_OPENSSL
+#include "ssl/support.h"
+#endif
 
 #if HAVE_OPENSSL_ERR_H
 #include <openssl/err.h>
@@ -96,6 +99,8 @@ Security::ServerOptions::createBlankContext() const
     Security::ContextPtr t = nullptr;
 
 #if USE_OPENSSL
+    Ssl::Initialize();
+
 #if (OPENSSL_VERSION_NUMBER >= 0x10100000L)
     t = SSL_CTX_new(TLS_server_method());
 #else

diff --git a/src/ssl/support.cc b/src/ssl/support.cc
index 223ce11a1f91065644f01ef371bc1e8af8ca4921..e1cd25dc61ba0cdfed843c3c0c3e1159564a53b4 100644 (file)
--- a/src/ssl/support.cc
+++ b/src/ssl/support.cc
@@ -430,9 +430,8 @@ ssl_free_SBuf(void *, void *ptr, CRYPTO_EX_DATA *,
     delete buf;
 }
 
-/// \ingroup ServerProtocolSSLInternal
-static void
-ssl_initialize(void)
+void
+Ssl::Initialize(void)
 {
     static bool initialized = false;
     if (initialized)
@@ -443,10 +442,10 @@ ssl_initialize(void)
     SSLeay_add_ssl_algorithms();
 
 #if HAVE_OPENSSL_ENGINE_H
-    if (Config.SSL.ssl_engine) {
+    if (::Config.SSL.ssl_engine) {
         ENGINE *e;
-        if (!(e = ENGINE_by_id(Config.SSL.ssl_engine)))
-            fatalf("Unable to find SSL engine '%s'\n", Config.SSL.ssl_engine);
+        if (!(e = ENGINE_by_id(::Config.SSL.ssl_engine)))
+            fatalf("Unable to find SSL engine '%s'\n", ::Config.SSL.ssl_engine);
 
         if (!ENGINE_set_default(e, ENGINE_METHOD_ALL)) {
             const int ssl_error = ERR_get_error();
@@ -454,11 +453,11 @@ ssl_initialize(void)
         }
     }
 #else
-    if (Config.SSL.ssl_engine)
+    if (::Config.SSL.ssl_engine)
         fatalf("Your OpenSSL has no SSL engine support\n");
 #endif
 
-    const char *defName = Config.SSL.certSignHash ? Config.SSL.certSignHash : SQUID_SSL_SIGN_HASH_IF_NONE;
+    const char *defName = ::Config.SSL.certSignHash ? ::Config.SSL.certSignHash : SQUID_SSL_SIGN_HASH_IF_NONE;
     Ssl::DefaultSignHash = EVP_get_digestbyname(defName);
     if (!Ssl::DefaultSignHash)
         fatalf("Sign hash '%s' is not supported\n", defName);
@@ -560,8 +559,6 @@ configureSslContext(Security::ContextPtr sslContext, AnyP::PortCfg &port)
 Security::ContextPtr
 sslCreateServerContext(AnyP::PortCfg &port)
 {
-    ssl_initialize();
-
     Security::ContextPtr sslContext(port.secure.createBlankContext());
     if (!sslContext)
         return nullptr;
@@ -636,7 +633,7 @@ ssl_next_proto_cb(SSL *s, unsigned char **out, unsigned char *outlen, const unsi
 Security::ContextPtr
 sslCreateClientContext(const char *certfile, const char *keyfile, const char *cipher, long options, long fl)
 {
-    ssl_initialize();
+    Ssl::Initialize();
 
 #if (OPENSSL_VERSION_NUMBER >= 0x10100000L)
     Security::ContextPtr sslContext(SSL_CTX_new(TLS_client_method()));

diff --git a/src/ssl/support.h b/src/ssl/support.h
index 2920b5ada20469e275957a5806db93c6cce47994..530a78ccf6aadae24c3fb6253a405dd13ae54a6d 100644 (file)
--- a/src/ssl/support.h
+++ b/src/ssl/support.h
@@ -56,6 +56,10 @@ class PortCfg;
 
 namespace Ssl
 {
+/// initialize the SSL library global state.
+/// call before generating any SSL context
+void Initialize();
+
 /// Squid defined error code (<0),  an error code returned by SSL X509 api, or SSL_ERROR_NONE
 typedef int ssl_error_t;