Copilot commented on code in PR #13350:
URL: https://github.com/apache/trafficserver/pull/13350#discussion_r3684051018
##########
src/iocore/net/SSLUtils.cc:
##########
@@ -856,43 +856,24 @@ SSLMultiCertConfigLoader::default_server_ssl_ctx()
static bool
SSLPrivateKeyHandler(SSL_CTX *ctx, const char *keyPath, const char
*secret_data, int secret_data_len)
{
- EVP_PKEY *pkey = nullptr;
-#if HAVE_ENGINE_GET_DEFAULT_RSA && HAVE_ENGINE_LOAD_PRIVATE_KEY
- ENGINE *e = ENGINE_get_default_RSA();
- if (e != nullptr) {
- pkey = ENGINE_load_private_key(e, keyPath, nullptr, nullptr);
- if (pkey) {
- if (!SSL_CTX_use_PrivateKey(ctx, pkey)) {
- Dbg(dbg_ctl_ssl_load, "failed to load server private key from engine");
- EVP_PKEY_free(pkey);
- return false;
- }
- }
+ bool result{false};
+ if (keyPath && keyPath[0] != '\0') {
+ result = use_pkey_from_file(ctx, keyPath);
}
-#else
- void *e = nullptr;
-#endif
- if (pkey == nullptr) {
- scoped_BIO bio(BIO_new_mem_buf(secret_data, secret_data_len));
-
- pem_password_cb *password_cb = SSL_CTX_get_default_passwd_cb(ctx);
- void *u = SSL_CTX_get_default_passwd_cb_userdata(ctx);
- pkey = PEM_read_bio_PrivateKey(bio.get(), nullptr,
password_cb, u);
- if (nullptr == pkey) {
- Dbg(dbg_ctl_ssl_load, "failed to load server private key (%.*s) from
%s", secret_data_len < 50 ? secret_data_len : 50,
- secret_data, (!keyPath || keyPath[0] == '\0') ? "[empty key path]" :
keyPath);
- return false;
- }
- if (!SSL_CTX_use_PrivateKey(ctx, pkey)) {
- Dbg(dbg_ctl_ssl_load, "failed to attach server private key loaded from
%s",
- (!keyPath || keyPath[0] == '\0') ? "[empty key path]" : keyPath);
- EVP_PKEY_free(pkey);
- return false;
- }
- if (e == nullptr && !SSL_CTX_check_private_key(ctx)) {
- Dbg(dbg_ctl_ssl_load, "server private key does not match the certificate
public key");
- return false;
- }
+
+ if (!result) {
+ result = use_pkey_from_secret_data(ctx, secret_data, secret_data_len);
+ }
+
+ if (!result) {
+ Dbg(dbg_ctl_ssl_load, "failed to load server private key (%.*s) from %s",
secret_data_len < 50 ? secret_data_len : 50,
+ secret_data, (!keyPath || keyPath[0] == '\0') ? "[empty key path]" :
keyPath);
+ return false;
+ }
+
+ if (!SSL_CTX_check_private_key(ctx)) {
+ Dbg(dbg_ctl_ssl_load, "server private key does not match the certificate
public key");
+ return false;
Review Comment:
This changes behavior for ENGINE-backed keys: the previous implementation
skipped `SSL_CTX_check_private_key(ctx)` when the key came from an ENGINE (`e
!= nullptr`). With the new structure, `SSL_CTX_check_private_key` is always
called, which can break configurations where the ENGINE provides a key type or
handle that can’t be verified via `SSL_CTX_check_private_key`. To preserve
behavior, have `use_pkey_from_file` report whether the key was loaded from
ENGINE (e.g., an out-param/enum), and only run `SSL_CTX_check_private_key` when
the key was loaded from file/secret (not from ENGINE).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
