From 6d395b766fd816cf2e7feea3286a689e635e35f9 Mon Sep 17 00:00:00 2001 From: Willy Tarreau Date: Wed, 6 Oct 2021 14:48:37 +0200 Subject: CLEANUP: server: always include the storage for SSL settings The SSL stuff in struct server takes less than 3% of it and requires lots of annoying ifdefs in the code just to take care of the cases where the field is absent. Let's get rid of this and stop including openssl-compat from server.c to detect NPN and ALPN capabilities. This reduces the total LoC by another 0.4%. (cherry picked from commit 80527bcb9d51d8506c8e7ef95de9c30d30722719) Signed-off-by: Christopher Faulet (cherry picked from commit 5279e61cee28b7012619906048edd2c8a9c89059) [wt: backported again to fix backport issues around SSL fields. It previously broke due to the absence of 'CLEANUP: servers: do not include openssl-compat' that was backported now] Signed-off-by: Willy Tarreau --- include/haproxy/server-t.h | 2 -- src/server.c | 21 +++------------------ 2 files changed, 3 insertions(+), 20 deletions(-) diff --git a/include/haproxy/server-t.h b/include/haproxy/server-t.h index 32b649bf3..90485f0c4 100644 --- include/haproxy/server-t.h +++ include/haproxy/server-t.h @@ -336,7 +336,6 @@ struct server { unsigned int init_addr_methods; /* initial address setting, 3-bit per method, ends at 0, enough to store 10 entries */ enum srv_log_proto log_proto; /* used proto to emit messages on server lines from ring section */ -#ifdef USE_OPENSSL char *sni_expr; /* Temporary variable to store a sample expression for SNI */ struct { void *ctx; @@ -367,7 +366,6 @@ struct server { #ifdef USE_QUIC struct quic_transport_params quic_params; /* QUIC transport parameters */ struct eb_root cids; /* QUIC connections IDs. */ -#endif #endif struct resolv_srvrq *srvrq; /* Pointer representing the DNS SRV requeest, if any */ struct list srv_rec_item; /* to attach server to a srv record item */ diff --git a/src/server.c b/src/server.c index 54637dc9c..ea3271957 100644 --- src/server.c +++ src/server.c @@ -1943,7 +1943,6 @@ const char *server_parse_maxconn_change_request(struct server *sv, return NULL; } -#ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME static struct sample_expr *srv_sni_sample_parse_expr(struct server *srv, struct proxy *px, const char *file, int linenum, char **err) { @@ -1983,7 +1982,6 @@ static int server_parse_sni_expr(struct server *newsrv, struct proxy *px, char * return 0; } -#endif static void display_parser_err(const char *file, int linenum, char **args, int cur_arg, int err_code, char **err) { @@ -2080,14 +2078,11 @@ static void srv_ssl_settings_cpy(struct server *srv, struct server *src) if (src->ssl_ctx.methods.max) srv->ssl_ctx.methods.max = src->ssl_ctx.methods.max; -#ifdef HAVE_SSL_CTX_SET_CIPHERSUITES if (src->ssl_ctx.ciphersuites != NULL) srv->ssl_ctx.ciphersuites = strdup(src->ssl_ctx.ciphersuites); -#endif if (src->sni_expr != NULL) srv->sni_expr = strdup(src->sni_expr); -#ifdef TLSEXT_TYPE_application_layer_protocol_negotiation if (src->ssl_ctx.alpn_str) { srv->ssl_ctx.alpn_str = malloc(src->ssl_ctx.alpn_len); if (srv->ssl_ctx.alpn_str) { @@ -2096,8 +2091,7 @@ static void srv_ssl_settings_cpy(struct server *srv, struct server *src) srv->ssl_ctx.alpn_len = src->ssl_ctx.alpn_len; } } -#endif -#ifdef OPENSSL_NPN_NEGOTIATED + if (src->ssl_ctx.npn_str) { srv->ssl_ctx.npn_str = malloc(src->ssl_ctx.npn_len); if (srv->ssl_ctx.npn_str) { @@ -2106,7 +2100,6 @@ static void srv_ssl_settings_cpy(struct server *srv, struct server *src) srv->ssl_ctx.npn_len = src->ssl_ctx.npn_len; } } -#endif } #endif @@ -2463,13 +2456,13 @@ static int _srv_parse_tmpl_init(struct server *srv, struct proxy *px) srv_settings_cpy(newsrv, srv, 1); srv_prepare_for_resolution(newsrv, srv->hostname); -#ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME + if (newsrv->sni_expr) { newsrv->ssl_ctx.sni = srv_sni_sample_parse_expr(newsrv, px, NULL, 0, NULL); if (!newsrv->ssl_ctx.sni) goto err; } -#endif + /* append to list of servers available to receive an hostname */ if (newsrv->srvrq) LIST_APPEND(&newsrv->srvrq->attached_servers, &newsrv->srv_rec_item); @@ -2488,9 +2481,7 @@ static int _srv_parse_tmpl_init(struct server *srv, struct proxy *px) err: _srv_parse_set_id_from_prefix(srv, srv->tmpl_info.prefix, srv->tmpl_info.nb_low); if (newsrv) { -#ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME release_sample_expr(newsrv->ssl_ctx.sni); -#endif free_check(&newsrv->agent); free_check(&newsrv->check); LIST_DELETE(&newsrv->global_list); @@ -2748,7 +2739,6 @@ static int _srv_parse_kw(struct server *srv, char **args, int *cur_arg, return err_code; } -#ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME /* This function is first intended to be used through parse_server to * initialize a new server on startup. */ @@ -2767,7 +2757,6 @@ static int _srv_parse_sni_expr_init(char **args, int cur_arg, return ret; } -#endif /* Server initializations finalization. * Initialize health check, agent check and SNI expression if enabled. @@ -2780,9 +2769,7 @@ static int _srv_parse_finalize(char **args, int cur_arg, struct server *srv, struct proxy *px, int parse_flags, char **errmsg) { -#ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME int ret; -#endif if (srv->do_check && srv->trackit) { memprintf(errmsg, "unable to enable checks and tracking at the same time!"); @@ -2795,10 +2782,8 @@ static int _srv_parse_finalize(char **args, int cur_arg, return ERR_ALERT | ERR_FATAL; } -#ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME if ((ret = _srv_parse_sni_expr_init(args, cur_arg, srv, px, errmsg)) != 0) return ret; -#endif /* A dynamic server is disabled on startup. It must not be counted as * an active backend entry. -- 2.28.0