isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Move allocation of the TLS context to logsrvd_conf_apply().

Browse Source 
This way we get certificate errors at configuration time, not after.
It also means that a change to the config file that renders the TLS
settings invalid will no longer cause the server to exit.  The new
config will just be ignored as if there was a syntax error.
This commit is contained in:
Todd C. Miller
2021-04-08 15:31:33 -06:00
parent 8f0c16f06e
commit 990fa4f5ad
2 changed files with 32 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
logsrvd/logsrvd_conf.c
View File

@@ -1124,6 +1124,9 @@ bad:
static bool
logsrvd_conf_apply(struct logsrvd_config *config)
{
#if defined(HAVE_OPENSSL)
struct server_address *addr;
#endif
debug_decl(logsrvd_conf_apply, SUDO_DEBUG_UTIL);
/* There can be multiple addresses so we can't set a default earlier. */
@@ -1138,8 +1141,6 @@ logsrvd_conf_apply(struct logsrvd_config *config)
debug_return_bool(false);
}
} else {
struct server_address *addr;
/* Check that TLS configuration is valid. */
TAILQ_FOREACH(addr, &config->server.addresses.addrs, entries) {
if (!addr->tls)
@@ -1161,6 +1162,27 @@ logsrvd_conf_apply(struct logsrvd_config *config)
#endif
}
#if defined(HAVE_OPENSSL)
TAILQ_FOREACH(addr, &config->server.addresses.addrs, entries) {
if (!addr->tls)
continue;
/* Create a TLS context for the server. */
config->server.tls_runtime.ssl_ctx = init_tls_context(
config->server.tls_config.cacert_path,
config->server.tls_config.cert_path,
config->server.tls_config.pkey_path,
config->server.tls_config.dhparams_path,
config->server.tls_config.ciphers_v12,
config->server.tls_config.ciphers_v13,
config->server.tls_config.verify);
if (config->server.tls_runtime.ssl_ctx == NULL) {
sudo_warnx(U_("unable to initialize server TLS context"));
debug_return_bool(false);
}
break;
}
#endif /* HAVE_OPENSSL */
/* Open event log if specified. */
switch (config->eventlog.log_type) {
case EVLOG_SYSLOG: