diff options
| author | Sergey Kandaurov <pluknet@nginx.com> | 2014-10-24 04:28:00 -0700 |
|---|---|---|
| committer | Sergey Kandaurov <pluknet@nginx.com> | 2014-10-24 04:28:00 -0700 |
| commit | 33f55559408f20e88b11fb45535ce6a6127f676e (patch) | |
| tree | 6fa062cb4d65822e98f4ac8f5119c53b960e3d86 | |
| parent | 54606d4625e69730dd6b45cba4117215390d284e (diff) | |
| download | nginx-33f55559408f20e88b11fb45535ce6a6127f676e.tar.gz nginx-33f55559408f20e88b11fb45535ce6a6127f676e.zip | |
SSL: simplified ssl_password_file error handling.
Instead of collecting a number of the possible SSL_CTX_use_PrivateKey_file()
error codes that becomes more and more difficult with the rising variety of
OpenSSL versions and its derivatives, just continue with the next password.
Multiple passwords in a single ssl_password_file feature was broken after
recent OpenSSL changes (commit 4aac102f75b517bdb56b1bcfd0a856052d559f6e).
Affected OpenSSL releases: 0.9.8zc, 1.0.0o, 1.0.1j and 1.0.2-beta3.
Reported by Piotr Sikora.
| -rw-r--r-- | src/event/ngx_event_openssl.c | 17 |
1 files changed, 3 insertions, 14 deletions
diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c index f34565277..77600298c 100644 --- a/src/event/ngx_event_openssl.c +++ b/src/event/ngx_event_openssl.c @@ -404,20 +404,9 @@ ngx_ssl_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert, } if (--tries) { - n = ERR_peek_error(); - -#ifdef OPENSSL_IS_BORINGSSL - if (ERR_GET_LIB(n) == ERR_LIB_CIPHER - && ERR_GET_REASON(n) == CIPHER_R_BAD_DECRYPT) -#else - if (ERR_GET_LIB(n) == ERR_LIB_EVP - && ERR_GET_REASON(n) == EVP_R_BAD_DECRYPT) -#endif - { - ERR_clear_error(); - SSL_CTX_set_default_passwd_cb_userdata(ssl->ctx, ++pwd); - continue; - } + ERR_clear_error(); + SSL_CTX_set_default_passwd_cb_userdata(ssl->ctx, ++pwd); + continue; } ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0, |