MINOR: quic-be: Add a function for the TLS context allocations

Implement ssl_quic_srv_new_ssl_ctx() whose aim is to allocate a TLS context
for QUIC servers.

diff --git a/include/haproxy/quic_ssl.h b/include/haproxy/quic_ssl.h
index 504d7f03a44ab1f0fae6dd9801518b51d633cdf9..1d4bd590c2e60917e7214dba58de91d46c020a72 100644 (file)
--- a/include/haproxy/quic_ssl.h
+++ b/include/haproxy/quic_ssl.h
@@ -34,6 +34,7 @@
 #include <haproxy/ssl_sock-t.h>
 
 int ssl_quic_initial_ctx(struct bind_conf *bind_conf);
+SSL_CTX *ssl_quic_srv_new_ssl_ctx(void);
 int qc_alloc_ssl_sock_ctx(struct quic_conn *qc);
 int qc_ssl_provide_all_quic_data(struct quic_conn *qc, struct ssl_sock_ctx *ctx);
 int quic_ssl_set_tls_cbs(SSL *ssl);

diff --git a/src/quic_ssl.c b/src/quic_ssl.c
index 4b2cede1813d0a3497590dc8e06cfe744cc893b7..21fe16255f02cece19fbdbfc28a2b622a47cbad5 100644 (file)
--- a/src/quic_ssl.c
+++ b/src/quic_ssl.c
@@ -754,6 +754,35 @@ int ssl_quic_initial_ctx(struct bind_conf *bind_conf)
        return cfgerr;
 }
 
+/* Allocate a TLS context for a QUIC server.
+ * Return this context if succeeded, NULL if failed.
+ */
+SSL_CTX *ssl_quic_srv_new_ssl_ctx(void)
+{
+       SSL_CTX *ctx;
+       /* XXX TODO: check this: XXX */
+       long options =
+               (SSL_OP_ALL & ~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS) |
+               SSL_OP_SINGLE_ECDH_USE |
+               SSL_OP_CIPHER_SERVER_PREFERENCE;
+
+       TRACE_ENTER(QUIC_EV_CONN_NEW);
+
+       ctx = SSL_CTX_new(TLS_client_method());
+       if (!ctx) {
+               TRACE_ERROR("Could not allocate a new TLS context", QUIC_EV_CONN_NEW);
+               goto leave;
+       }
+
+       SSL_CTX_set_options(ctx, options);
+       SSL_CTX_set_min_proto_version(ctx, TLS1_3_VERSION);
+       SSL_CTX_set_max_proto_version(ctx, TLS1_3_VERSION);
+
+ leave:
+       TRACE_LEAVE(QUIC_EV_CONN_NEW);
+       return ctx;
+}
+
 /* This function gives the detail of the SSL error. It is used only
  * if the debug mode and the verbose mode are activated. It dump all
  * the SSL error until the stack was empty.