BUG/MEDIUM: ssl: Fix regression about certificates generation

Since the commit f6b37c67 ["BUG/MEDIUM: ssl: in bind line, ssl-options after
'crt' are ignored."], the certificates generation is broken.

To generate a certificate, we retrieved the private key of the default
certificate using the SSL object. But since the commit f6b37c67, the SSL object
is created with a dummy certificate (initial_ctx).

So to fix the bug, we use directly the default certificate in the bind_conf
structure. We use SSL_CTX_get0_privatekey function to do so. Because this
function does not exist for OpenSSL < 1.0.2 and for LibreSSL, it has been added
in openssl-compat.h with the right #ifdef.

diff --git a/include/proto/openssl-compat.h b/include/proto/openssl-compat.h
index ea92072e559e0fbd61c82d1724d905c2a5350efe..9b671095d3653311e3fdfe7a73019bacc413a8e6 100644 (file)
--- a/include/proto/openssl-compat.h
+++ b/include/proto/openssl-compat.h
@@ -89,6 +89,19 @@ static inline int SSL_SESSION_set1_id_context(SSL_SESSION *s, const unsigned cha
 }
 #endif
 
+#if (OPENSSL_VERSION_NUMBER < 0x10002000L) || defined(LIBRESSL_VERSION_NUMBER)
+/*
+ * Functions introduced in OpenSSL 1.0.2 and not yet present in LibreSSL
+ */
+EVP_PKEY *SSL_CTX_get0_privatekey(const SSL_CTX *ctx)
+{
+       if (ctx->cert != NULL)
+               return ctx->cert->key->privatekey;
+       else
+               return NULL;
+}
+#endif
+
 #if (OPENSSL_VERSION_NUMBER < 0x1010000fL) || defined(LIBRESSL_VERSION_NUMBER)
 /*
  * Functions introduced in OpenSSL 1.1.0 and not yet present in LibreSSL

diff --git a/src/ssl_sock.c b/src/ssl_sock.c
index b4d4e14fe79a6df4def05fb515aafcde44852713..d81dd70cb5c5899d12ac540becce2953636f60ea 100644 (file)
--- a/src/ssl_sock.c
+++ b/src/ssl_sock.c
@@ -1586,8 +1586,8 @@ ssl_sock_do_create_cert(const char *servername, struct bind_conf *bind_conf, SSL
        unsigned int  i;
        int           key_type;
 
-       /* Get the private key of the defautl certificate and use it */
-       if (!(pkey = SSL_get_privatekey(ssl)))
+       /* Get the private key of the default certificate and use it */
+       if (!(pkey = SSL_CTX_get0_privatekey(bind_conf->default_ctx)))
                goto mkcert_error;
 
        /* Create the certificate */