From c21c0e3e5676d4c74e6c4784ea59c42b7baef19f Mon Sep 17 00:00:00 2001 From: Emmanuel Hocdet Date: Thu, 21 Nov 2019 19:09:31 +0100 Subject: [PATCH 3/3] MINOR: ssl: deduplicate crl-file Load file for crl or ca-cert is realy done with the same function in OpenSSL, via X509_STORE_load_locations. Accordingly, deduplicate crl-file and ca-file can share the same function. --- src/ssl_sock.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/ssl_sock.c b/src/ssl_sock.c index 848f0f242..a1ab05170 100644 --- a/src/ssl_sock.c +++ b/src/ssl_sock.c @@ -375,7 +375,7 @@ static struct { } ckchs_transaction; /* - * deduplicate cafile + * deduplicate cafile (and crlfile) */ struct cafile_entry { X509_STORE *ca_store; @@ -5059,7 +5059,7 @@ int ssl_sock_prepare_ctx(struct bind_conf *bind_conf, struct ssl_bind_conf *ssl_ if (crl_file) { X509_STORE *store = SSL_CTX_get_cert_store(ctx); - if (!store || !X509_STORE_load_locations(store, crl_file, NULL)) { + if (!ssl_load_cert_crl_file(store, crl_file)) { if (err) memprintf(err, "%sProxy '%s': unable to configure CRL file '%s' for bind '%s' at [%s:%d].\n", *err ? *err : "", curproxy->id, crl_file, bind_conf->arg, bind_conf->file, bind_conf->line); @@ -5565,7 +5565,7 @@ int ssl_sock_prepare_srv_ctx(struct server *srv) if (srv->ssl_ctx.crl_file) { X509_STORE *store = SSL_CTX_get_cert_store(srv->ssl_ctx.ctx); - if (!store || !X509_STORE_load_locations(store, srv->ssl_ctx.crl_file, NULL)) { + if (!ssl_load_cert_crl_file(store, srv->ssl_ctx.crl_file)) { ha_alert("Proxy '%s', server '%s' [%s:%d] unable to configure CRL file '%s'.\n", curproxy->id, srv->id, srv->conf.file, srv->conf.line, srv->ssl_ctx.crl_file); -- 2.11.0