]> git.ipfire.org Git - thirdparty/haproxy.git/commit
BUG/MEDIUM: ssl: in bind line, ssl-options after 'crt' are ignored.
authorEmmanuel Hocdet <manu@gandi.net>
Mon, 6 Mar 2017 14:34:44 +0000 (15:34 +0100)
committerWilly Tarreau <w@1wt.eu>
Tue, 7 Mar 2017 09:42:43 +0000 (10:42 +0100)
commitf6b37c67be277b5f0ae60438d796ff29ef19be40
treeede02b2e437cef13c9c86ec26a7857b0b2925d24
parent4608ed9511a0bc7f96e22376953d1b05de466cfd
BUG/MEDIUM: ssl: in bind line, ssl-options after 'crt' are ignored.

Bug introduced with "removes SSL_CTX_set_ssl_version call and cleanup CTX
creation": ssl_sock_new_ctx is called before all the bind line is parsed.
The fix consists of separating the use of default_ctx as the initialization
context of the SSL connection via bind_conf->initial_ctx. Initial_ctx contains
all the necessary parameters before performing the selection of the CTX:
default_ctx is processed as others ctx without unnecessary parameters.
include/types/listener.h
src/ssl_sock.c