That's my fault. I was aware of the versioning but forgot to wrap in ifdef there. Configuration prevents from setting those settings on unsupported versions.
On Sun, Jul 5, 2020 at 2:57 PM Илья Шипицин <chipits...@gmail.com> wrote: > https://cirrus-ci.com/task/6191727960653824 > > seems, openssl-1.0.0 (used in CentOS6/RHEL6) does not support those > methods. > > haproxy claims to support openssl starting 0.9.8, I guess openssl-0.9.8 is > rarely tested > > вс, 5 июл. 2020 г. в 16:48, Gersner <gers...@gmail.com>: > >> Awesome. I will run the manual tests on the variants later today. >> Thanks. >> >> On Sun, Jul 5, 2020 at 2:45 PM Илья Шипицин <chipits...@gmail.com> wrote: >> >>> if you have tested your code (I'm sure you did), maybe manual testing >>> will be simple enough >>> you just need to rebuild haproxy against LibreSSL, BoringSSL, older >>> openssl >>> >>> examples how to build ssl lib and build haproxy against it might be >>> taken from .travis.yml (I was about to write an article, but I'm lazy) >>> >>> вс, 5 июл. 2020 г. в 16:16, Gersner <gers...@gmail.com>: >>> >>>> Oh, wasn't aware of that. >>>> Is there some automation to test this or should I manually verify this? >>>> >>>> >>>> On Sun, Jul 5, 2020 at 2:13 PM Илья Шипицин <chipits...@gmail.com> >>>> wrote: >>>> >>>>> I recall some issues with LibreSSL and chaining trust. Like it was >>>>> declared but never worked. >>>>> we'll see that in runtime if there are such issues >>>>> >>>>> вс, 5 июл. 2020 г. в 16:06, Илья Шипицин <chipits...@gmail.com>: >>>>> >>>>>> nice, all ssl variants build well >>>>>> https://travis-ci.com/github/chipitsine/haproxy/builds/174323866 >>>>>> >>>>>> вс, 5 июл. 2020 г. в 15:48, Gersner <gers...@gmail.com>: >>>>>> >>>>>>> >>>>>>> >>>>>>> On Sun, Jul 5, 2020 at 1:42 PM Илья Шипицин <chipits...@gmail.com> >>>>>>> wrote: >>>>>>> >>>>>>>> do you have your patches on github fork ? >>>>>>>> (I could not find your fork) >>>>>>>> >>>>>>> Yes. See branch >>>>>>> https://github.com/Azure/haproxy/tree/wip/sgersner/ca-sign-extra >>>>>>> >>>>>>>> >>>>>>>> вс, 5 июл. 2020 г. в 15:13, Gersner <gers...@gmail.com>: >>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> On Sun, Jul 5, 2020 at 12:28 PM Илья Шипицин <chipits...@gmail.com> >>>>>>>>> wrote: >>>>>>>>> >>>>>>>>>> does it clearly applies to current master ? either gmail >>>>>>>>>> scrambled patch or it is not. >>>>>>>>>> can you try please ? >>>>>>>>>> >>>>>>>>> Exporting the eml and running 'git am' it works cleanly. >>>>>>>>> >>>>>>>>> I've reproduced the exact same output when copy-pasting from >>>>>>>>> gmail. It seems gmail converts the tabs to spaces and this fails the >>>>>>>>> patch >>>>>>>>> (Not sure why). >>>>>>>>> Running patch with '-l' will resolve this, but it's probably safer >>>>>>>>> to run git am on the email. >>>>>>>>> >>>>>>>>> >>>>>>>>>> >>>>>>>>>> $ patch -p1 < 1.patch >>>>>>>>>> patching file doc/configuration.txt >>>>>>>>>> patching file include/haproxy/listener-t.h >>>>>>>>>> Hunk #1 FAILED at 163. >>>>>>>>>> 1 out of 1 hunk FAILED -- saving rejects to file >>>>>>>>>> include/haproxy/listener-t.h.rej >>>>>>>>>> patching file src/cfgparse-ssl.c >>>>>>>>>> Hunk #1 succeeded at 538 with fuzz 1. >>>>>>>>>> Hunk #2 FAILED at 1720. >>>>>>>>>> 1 out of 2 hunks FAILED -- saving rejects to file >>>>>>>>>> src/cfgparse-ssl.c.rej >>>>>>>>>> patching file src/ssl_sock.c >>>>>>>>>> Hunk #1 FAILED at 1750. >>>>>>>>>> Hunk #2 FAILED at 1864. >>>>>>>>>> Hunk #3 FAILED at 1912. >>>>>>>>>> Hunk #4 FAILED at 1943. >>>>>>>>>> Hunk #5 FAILED at 1970. >>>>>>>>>> Hunk #6 FAILED at 4823. >>>>>>>>>> Hunk #7 FAILED at 4843. >>>>>>>>>> 7 out of 7 hunks FAILED -- saving rejects to file >>>>>>>>>> src/ssl_sock.c.rej >>>>>>>>>> >>>>>>>>>> вс, 5 июл. 2020 г. в 11:46, <gers...@gmail.com>: >>>>>>>>>> >>>>>>>>>>> From: Shimi Gersner <sgers...@microsoft.com> >>>>>>>>>>> >>>>>>>>>>> haproxy supports generating SSL certificates based on SNI using >>>>>>>>>>> a provided >>>>>>>>>>> CA signing certificate. Because CA certificates may be signed by >>>>>>>>>>> multiple >>>>>>>>>>> CAs, in some scenarios, it is neccesary for the server to attach >>>>>>>>>>> the trust chain >>>>>>>>>>> in addition to the generated certificate. >>>>>>>>>>> >>>>>>>>>>> The following patch adds the ability to optionally serve all >>>>>>>>>>> public >>>>>>>>>>> certificates provided in the `ca-sign-file` PEM file. >>>>>>>>>>> Certificate loading was ported to use `ca_sign_use_chain` >>>>>>>>>>> structure, >>>>>>>>>>> instead of directly reading public/private keys. >>>>>>>>>>> --- >>>>>>>>>>> doc/configuration.txt | 8 +++ >>>>>>>>>>> include/haproxy/listener-t.h | 4 +- >>>>>>>>>>> src/cfgparse-ssl.c | 13 +++++ >>>>>>>>>>> src/ssl_sock.c | 98 >>>>>>>>>>> ++++++++++++++++++++---------------- >>>>>>>>>>> 4 files changed, 78 insertions(+), 45 deletions(-) >>>>>>>>>>> >>>>>>>>>>> diff --git a/doc/configuration.txt b/doc/configuration.txt >>>>>>>>>>> index 6d472134e..1d3878bc1 100644 >>>>>>>>>>> --- a/doc/configuration.txt >>>>>>>>>>> +++ b/doc/configuration.txt >>>>>>>>>>> @@ -12158,6 +12158,14 @@ ca-sign-pass <passphrase> >>>>>>>>>>> the dynamic generation of certificates is enabled. See >>>>>>>>>>> 'generate-certificates' for details. >>>>>>>>>>> >>>>>>>>>>> +ca-sign-use-chain >>>>>>>>>>> + This setting is only available when support for OpenSSL was >>>>>>>>>>> built in. It is >>>>>>>>>>> + the CA private key passphrase. This setting is optional and >>>>>>>>>>> used only when >>>>>>>>>>> + the dynamic generation of certificates is enabled. See >>>>>>>>>>> + 'generate-certificates' for details. >>>>>>>>>>> + Enabling this flag will attach all public certificates >>>>>>>>>>> encoded in `ca-sign-file` >>>>>>>>>>> + to the served certificate to the client, enabling trust. >>>>>>>>>>> + >>>>>>>>>>> ca-verify-file <cafile> >>>>>>>>>>> This setting designates a PEM file from which to load CA >>>>>>>>>>> certificates used to >>>>>>>>>>> verify client's certificate. It designates CA certificates >>>>>>>>>>> which must not be >>>>>>>>>>> diff --git a/include/haproxy/listener-t.h >>>>>>>>>>> b/include/haproxy/listener-t.h >>>>>>>>>>> index 224e32513..38ca2839f 100644 >>>>>>>>>>> --- a/include/haproxy/listener-t.h >>>>>>>>>>> +++ b/include/haproxy/listener-t.h >>>>>>>>>>> @@ -163,8 +163,8 @@ struct bind_conf { >>>>>>>>>>> char *ca_sign_file; /* CAFile used to generate >>>>>>>>>>> and sign server certificates */ >>>>>>>>>>> char *ca_sign_pass; /* CAKey passphrase */ >>>>>>>>>>> >>>>>>>>>>> - X509 *ca_sign_cert; /* CA certificate referenced >>>>>>>>>>> by ca_file */ >>>>>>>>>>> - EVP_PKEY *ca_sign_pkey; /* CA private key referenced >>>>>>>>>>> by ca_key */ >>>>>>>>>>> + int ca_sign_use_chain; /* Optionally attached the >>>>>>>>>>> certificate chain to the served certificate */ >>>>>>>>>>> + struct cert_key_and_chain * ca_sign_ckch; /* CA >>>>>>>>>>> and possible certificate chain for ca generation */ >>>>>>>>>>> #endif >>>>>>>>>>> struct proxy *frontend; /* the frontend all these >>>>>>>>>>> listeners belong to, or NULL */ >>>>>>>>>>> const struct mux_proto_list *mux_proto; /* the mux to >>>>>>>>>>> use for all incoming connections (specified by the "proto" keyword) >>>>>>>>>>> */ >>>>>>>>>>> diff --git a/src/cfgparse-ssl.c b/src/cfgparse-ssl.c >>>>>>>>>>> index 144cef882..270c857f9 100644 >>>>>>>>>>> --- a/src/cfgparse-ssl.c >>>>>>>>>>> +++ b/src/cfgparse-ssl.c >>>>>>>>>>> @@ -538,6 +538,18 @@ static int bind_parse_ca_sign_file(char >>>>>>>>>>> **args, int cur_arg, struct proxy *px, s >>>>>>>>>>> return 0; >>>>>>>>>>> } >>>>>>>>>>> >>>>>>>>>>> +/* parse the "ca-sign-use-chain" bind keyword */ >>>>>>>>>>> +static int bind_parse_ca_sign_use_chain(char **args, int >>>>>>>>>>> cur_arg, struct proxy *px, struct bind_conf *conf, char **err) >>>>>>>>>>> +{ >>>>>>>>>>> +#if (defined SSL_CTRL_SET_TLSEXT_HOSTNAME && !defined >>>>>>>>>>> SSL_NO_GENERATE_CERTIFICATES && defined SSL_CTX_set1_chain) >>>>>>>>>>> + conf->ca_sign_use_chain = 1; >>>>>>>>>>> +#else >>>>>>>>>>> + memprintf(err, "%sthis version of openssl cannot attach >>>>>>>>>>> certificate chain for SSL certificate generation.\n", >>>>>>>>>>> + err && *err ? *err : ""); >>>>>>>>>>> +#endif >>>>>>>>>>> + return 0; >>>>>>>>>>> +} >>>>>>>>>>> + >>>>>>>>>>> /* parse the "ca-sign-pass" bind keyword */ >>>>>>>>>>> static int bind_parse_ca_sign_pass(char **args, int cur_arg, >>>>>>>>>>> struct proxy *px, struct bind_conf *conf, char **err) >>>>>>>>>>> { >>>>>>>>>>> @@ -1708,6 +1720,7 @@ static struct bind_kw_list bind_kws = { >>>>>>>>>>> "SSL", { }, { >>>>>>>>>>> { "ca-ignore-err", bind_parse_ignore_err, >>>>>>>>>>> 1 }, /* set error IDs to ignore on verify depth > 0 */ >>>>>>>>>>> { "ca-sign-file", bind_parse_ca_sign_file, >>>>>>>>>>> 1 }, /* set CAFile used to generate and sign server certs */ >>>>>>>>>>> { "ca-sign-pass", bind_parse_ca_sign_pass, >>>>>>>>>>> 1 }, /* set CAKey passphrase */ >>>>>>>>>>> + { "ca-sign-use-chain", >>>>>>>>>>> bind_parse_ca_sign_use_chain, 1 }, /* enable attaching ca chain to >>>>>>>>>>> generated certificate */ >>>>>>>>>>> { "ciphers", bind_parse_ciphers, >>>>>>>>>>> 1 }, /* set SSL cipher suite */ >>>>>>>>>>> #if (HA_OPENSSL_VERSION_NUMBER >= 0x10101000L) >>>>>>>>>>> { "ciphersuites", bind_parse_ciphersuites, >>>>>>>>>>> 1 }, /* set TLS 1.3 cipher suite */ >>>>>>>>>>> diff --git a/src/ssl_sock.c b/src/ssl_sock.c >>>>>>>>>>> index a32db1a28..54829eb98 100644 >>>>>>>>>>> --- a/src/ssl_sock.c >>>>>>>>>>> +++ b/src/ssl_sock.c >>>>>>>>>>> @@ -1750,8 +1750,8 @@ static int >>>>>>>>>>> ssl_sock_advertise_alpn_protos(SSL *s, const unsigned char **out, >>>>>>>>>>> static SSL_CTX * >>>>>>>>>>> ssl_sock_do_create_cert(const char *servername, struct >>>>>>>>>>> bind_conf *bind_conf, SSL *ssl) >>>>>>>>>>> { >>>>>>>>>>> - X509 *cacert = bind_conf->ca_sign_cert; >>>>>>>>>>> - EVP_PKEY *capkey = bind_conf->ca_sign_pkey; >>>>>>>>>>> + X509 *cacert = bind_conf->ca_sign_ckch->cert; >>>>>>>>>>> + EVP_PKEY *capkey = bind_conf->ca_sign_ckch->key; >>>>>>>>>>> SSL_CTX *ssl_ctx = NULL; >>>>>>>>>>> X509 *newcrt = NULL; >>>>>>>>>>> EVP_PKEY *pkey = NULL; >>>>>>>>>>> @@ -1864,6 +1864,16 @@ ssl_sock_do_create_cert(const char >>>>>>>>>>> *servername, struct bind_conf *bind_conf, SSL >>>>>>>>>>> if (!SSL_CTX_check_private_key(ssl_ctx)) >>>>>>>>>>> goto mkcert_error; >>>>>>>>>>> >>>>>>>>>>> + /* Assign chain if any */ >>>>>>>>>>> + if (bind_conf->ca_sign_use_chain && >>>>>>>>>>> bind_conf->ca_sign_ckch->chain) { >>>>>>>>>>> + if (!SSL_CTX_set1_chain(ssl_ctx, >>>>>>>>>>> bind_conf->ca_sign_ckch->chain)) { >>>>>>>>>>> + goto mkcert_error; >>>>>>>>>>> + } >>>>>>>>>>> + if (!SSL_CTX_add1_chain_cert(ssl_ctx, >>>>>>>>>>> bind_conf->ca_sign_ckch->cert)) { >>>>>>>>>>> + goto mkcert_error; >>>>>>>>>>> + } >>>>>>>>>>> + } >>>>>>>>>>> + >>>>>>>>>>> if (newcrt) X509_free(newcrt); >>>>>>>>>>> >>>>>>>>>>> #ifndef OPENSSL_NO_DH >>>>>>>>>>> @@ -1912,7 +1922,7 @@ ssl_sock_assign_generated_cert(unsigned >>>>>>>>>>> int key, struct bind_conf *bind_conf, SS >>>>>>>>>>> >>>>>>>>>>> if (ssl_ctx_lru_tree) { >>>>>>>>>>> HA_RWLOCK_WRLOCK(SSL_GEN_CERTS_LOCK, >>>>>>>>>>> &ssl_ctx_lru_rwlock); >>>>>>>>>>> - lru = lru64_lookup(key, ssl_ctx_lru_tree, >>>>>>>>>>> bind_conf->ca_sign_cert, 0); >>>>>>>>>>> + lru = lru64_lookup(key, ssl_ctx_lru_tree, >>>>>>>>>>> bind_conf->ca_sign_ckch->cert, 0); >>>>>>>>>>> if (lru && lru->domain) { >>>>>>>>>>> if (ssl) >>>>>>>>>>> SSL_set_SSL_CTX(ssl, (SSL_CTX >>>>>>>>>>> *)lru->data); >>>>>>>>>>> @@ -1943,14 +1953,14 @@ ssl_sock_set_generated_cert(SSL_CTX >>>>>>>>>>> *ssl_ctx, unsigned int key, struct bind_conf >>>>>>>>>>> >>>>>>>>>>> if (ssl_ctx_lru_tree) { >>>>>>>>>>> HA_RWLOCK_WRLOCK(SSL_GEN_CERTS_LOCK, >>>>>>>>>>> &ssl_ctx_lru_rwlock); >>>>>>>>>>> - lru = lru64_get(key, ssl_ctx_lru_tree, >>>>>>>>>>> bind_conf->ca_sign_cert, 0); >>>>>>>>>>> + lru = lru64_get(key, ssl_ctx_lru_tree, >>>>>>>>>>> bind_conf->ca_sign_ckch->cert, 0); >>>>>>>>>>> if (!lru) { >>>>>>>>>>> HA_RWLOCK_WRUNLOCK(SSL_GEN_CERTS_LOCK, >>>>>>>>>>> &ssl_ctx_lru_rwlock); >>>>>>>>>>> return -1; >>>>>>>>>>> } >>>>>>>>>>> if (lru->domain && lru->data) >>>>>>>>>>> lru->free((SSL_CTX *)lru->data); >>>>>>>>>>> - lru64_commit(lru, ssl_ctx, >>>>>>>>>>> bind_conf->ca_sign_cert, 0, (void (*)(void *))SSL_CTX_free); >>>>>>>>>>> + lru64_commit(lru, ssl_ctx, >>>>>>>>>>> bind_conf->ca_sign_ckch->cert, 0, (void (*)(void *))SSL_CTX_free); >>>>>>>>>>> HA_RWLOCK_WRUNLOCK(SSL_GEN_CERTS_LOCK, >>>>>>>>>>> &ssl_ctx_lru_rwlock); >>>>>>>>>>> return 0; >>>>>>>>>>> } >>>>>>>>>>> @@ -1970,7 +1980,7 @@ ssl_sock_generated_cert_key(const void >>>>>>>>>>> *data, size_t len) >>>>>>>>>>> static int >>>>>>>>>>> ssl_sock_generate_certificate(const char *servername, struct >>>>>>>>>>> bind_conf *bind_conf, SSL *ssl) >>>>>>>>>>> { >>>>>>>>>>> - X509 *cacert = bind_conf->ca_sign_cert; >>>>>>>>>>> + X509 *cacert = bind_conf->ca_sign_ckch->cert; >>>>>>>>>>> SSL_CTX *ssl_ctx = NULL; >>>>>>>>>>> struct lru64 *lru = NULL; >>>>>>>>>>> unsigned int key; >>>>>>>>>>> @@ -4823,13 +4833,12 @@ int >>>>>>>>>>> ssl_sock_load_ca(struct bind_conf *bind_conf) >>>>>>>>>>> { >>>>>>>>>>> struct proxy *px = bind_conf->frontend; >>>>>>>>>>> - FILE *fp; >>>>>>>>>>> - X509 *cacert = NULL; >>>>>>>>>>> - EVP_PKEY *capkey = NULL; >>>>>>>>>>> - int err = 0; >>>>>>>>>>> + struct cert_key_and_chain *ckch = NULL; >>>>>>>>>>> + int ret = 0; >>>>>>>>>>> + char *err = NULL; >>>>>>>>>>> >>>>>>>>>>> if (!bind_conf->generate_certs) >>>>>>>>>>> - return err; >>>>>>>>>>> + return ret; >>>>>>>>>>> >>>>>>>>>>> #if (defined SSL_CTRL_SET_TLSEXT_HOSTNAME && !defined >>>>>>>>>>> SSL_NO_GENERATE_CERTIFICATES) >>>>>>>>>>> if (global_ssl.ctx_cache) { >>>>>>>>>>> @@ -4843,52 +4852,55 @@ ssl_sock_load_ca(struct bind_conf >>>>>>>>>>> *bind_conf) >>>>>>>>>>> ha_alert("Proxy '%s': cannot enable certificate >>>>>>>>>>> generation, " >>>>>>>>>>> "no CA certificate File configured at >>>>>>>>>>> [%s:%d].\n", >>>>>>>>>>> px->id, bind_conf->file, >>>>>>>>>>> bind_conf->line); >>>>>>>>>>> - goto load_error; >>>>>>>>>>> + goto failed; >>>>>>>>>>> } >>>>>>>>>>> >>>>>>>>>>> - /* read in the CA certificate */ >>>>>>>>>>> - if (!(fp = fopen(bind_conf->ca_sign_file, "r"))) { >>>>>>>>>>> - ha_alert("Proxy '%s': Failed to read CA >>>>>>>>>>> certificate file '%s' at [%s:%d].\n", >>>>>>>>>>> - px->id, bind_conf->ca_sign_file, >>>>>>>>>>> bind_conf->file, bind_conf->line); >>>>>>>>>>> - goto load_error; >>>>>>>>>>> + /* Allocate cert structure */ >>>>>>>>>>> + ckch = calloc(1, sizeof(struct cert_key_and_chain)); >>>>>>>>>>> + if (!ckch) { >>>>>>>>>>> + ha_alert("Proxy '%s': Failed to read CA >>>>>>>>>>> certificate file '%s' at [%s:%d]. Chain allocation failure\n", >>>>>>>>>>> + px->id, bind_conf->ca_sign_file, >>>>>>>>>>> bind_conf->file, bind_conf->line); >>>>>>>>>>> } >>>>>>>>>>> - if (!(cacert = PEM_read_X509(fp, NULL, NULL, NULL))) { >>>>>>>>>>> - ha_alert("Proxy '%s': Failed to read CA >>>>>>>>>>> certificate file '%s' at [%s:%d].\n", >>>>>>>>>>> - px->id, bind_conf->ca_sign_file, >>>>>>>>>>> bind_conf->file, bind_conf->line); >>>>>>>>>>> - goto read_error; >>>>>>>>>>> + >>>>>>>>>>> + /* Try to parse file */ >>>>>>>>>>> + if >>>>>>>>>>> (ssl_sock_load_files_into_ckch(bind_conf->ca_sign_file, ckch, >>>>>>>>>>> &err)) { >>>>>>>>>>> + ha_alert("Proxy '%s': Failed to read CA >>>>>>>>>>> certificate file '%s' at [%s:%d]. Chain loading failed: %s\n", >>>>>>>>>>> + px->id, bind_conf->ca_sign_file, >>>>>>>>>>> bind_conf->file, bind_conf->line, err); >>>>>>>>>>> + if (err) free(err); >>>>>>>>>>> + goto failed; >>>>>>>>>>> } >>>>>>>>>>> - rewind(fp); >>>>>>>>>>> - if (!(capkey = PEM_read_PrivateKey(fp, NULL, NULL, >>>>>>>>>>> bind_conf->ca_sign_pass))) { >>>>>>>>>>> - ha_alert("Proxy '%s': Failed to read CA private >>>>>>>>>>> key file '%s' at [%s:%d].\n", >>>>>>>>>>> - px->id, bind_conf->ca_sign_file, >>>>>>>>>>> bind_conf->file, bind_conf->line); >>>>>>>>>>> - goto read_error; >>>>>>>>>>> + >>>>>>>>>>> + /* Fail if missing cert or pkey */ >>>>>>>>>>> + if ((!ckch->cert) || (!ckch->key)) { >>>>>>>>>>> + ha_alert("Proxy '%s': Failed to read CA >>>>>>>>>>> certificate file '%s' at [%s:%d]. Chain missing certificate or >>>>>>>>>>> private >>>>>>>>>>> key\n", >>>>>>>>>>> + px->id, bind_conf->ca_sign_file, >>>>>>>>>>> bind_conf->file, bind_conf->line); >>>>>>>>>>> + goto failed; >>>>>>>>>>> } >>>>>>>>>>> >>>>>>>>>>> - fclose (fp); >>>>>>>>>>> - bind_conf->ca_sign_cert = cacert; >>>>>>>>>>> - bind_conf->ca_sign_pkey = capkey; >>>>>>>>>>> - return err; >>>>>>>>>>> + /* Final assignment to bind */ >>>>>>>>>>> + bind_conf->ca_sign_ckch = ckch; >>>>>>>>>>> + return ret; >>>>>>>>>>> + >>>>>>>>>>> + failed: >>>>>>>>>>> + if (ckch) { >>>>>>>>>>> + ssl_sock_free_cert_key_and_chain_contents(ckch); >>>>>>>>>>> + free(ckch); >>>>>>>>>>> + } >>>>>>>>>>> >>>>>>>>>>> - read_error: >>>>>>>>>>> - fclose (fp); >>>>>>>>>>> - if (capkey) EVP_PKEY_free(capkey); >>>>>>>>>>> - if (cacert) X509_free(cacert); >>>>>>>>>>> - load_error: >>>>>>>>>>> bind_conf->generate_certs = 0; >>>>>>>>>>> - err++; >>>>>>>>>>> - return err; >>>>>>>>>>> + ret++; >>>>>>>>>>> + return ret; >>>>>>>>>>> } >>>>>>>>>>> >>>>>>>>>>> /* Release CA cert and private key used to generate >>>>>>>>>>> certificated */ >>>>>>>>>>> void >>>>>>>>>>> ssl_sock_free_ca(struct bind_conf *bind_conf) >>>>>>>>>>> { >>>>>>>>>>> - if (bind_conf->ca_sign_pkey) >>>>>>>>>>> - EVP_PKEY_free(bind_conf->ca_sign_pkey); >>>>>>>>>>> - if (bind_conf->ca_sign_cert) >>>>>>>>>>> - X509_free(bind_conf->ca_sign_cert); >>>>>>>>>>> - bind_conf->ca_sign_pkey = NULL; >>>>>>>>>>> - bind_conf->ca_sign_cert = NULL; >>>>>>>>>>> + if (bind_conf->ca_sign_ckch) { >>>>>>>>>>> + >>>>>>>>>>> ssl_sock_free_cert_key_and_chain_contents(bind_conf->ca_sign_ckch); >>>>>>>>>>> + free(bind_conf->ca_sign_ckch); >>>>>>>>>>> + bind_conf->ca_sign_ckch = NULL; >>>>>>>>>>> + } >>>>>>>>>>> } >>>>>>>>>>> >>>>>>>>>>> /* >>>>>>>>>>> -- >>>>>>>>>>> 2.27.0 >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>>
