Viktor Dukhovni:
> The OpenSSL PEM file parser already ignores content outside of
> BEGIN/END boundaries, so the minimal patch to silently ignore
> unexpected PEM data would be:
>
> --- src/tls/tls_certkey.c
> +++ src/tls/tls_certkey.c
> @@ -412,9 +412,6 @@ static int load_pem_object(pem_load_state_t *st)
> || ((pkey_type = EVP_PKEY_DSA) != NID_undef
> && strcmp(name, PEM_STRING_DSA) == 0)) {
> load_pkey(st, pkey_type, buf, buflen);
> - } else if (!st->mixed) {
> - msg_warn("error loading %s: unexpected PEM type: %s", st->source, name);
> - st->state = PEM_LOAD_STATE_NOGO;
> }
> OPENSSL_free(name);
> OPENSSL_free(header);
I have adopted this for interoperability, but will log a warning
because ignoring inputs is not safe,
> On an mostly unrelated note, OpenSSL 3.0 (~Q4 2020) is changing the
> error API, so we'll eventually need:
>
> --- src/tls/tls_misc.c
> +++ src/tls/tls_misc.c
> @@ -1332,6 +1332,18 @@ void tls_print_errors(void)
> int line;
> int flags;
>
> +#if defined(OPENSSL_VERSION_PREREQ) && OPENSSL_VERSION_PREREQ(3,0)
Unfortunately that does not compile. Maybe we need a helper macro
like HAVE_GLIBC_API_VERSION_SUPPORT() in sys_defs.h.
Wietse
