CRL loading fails due to incorrect return code check #5040
Closed
Comments
smarsching
added a commit
to smarsching/icinga2
that referenced
this issue
Feb 27, 2017
The code for loading CRLs was incorrectly assuming that OpenSSL's X509_LOOKUP_load_file function returns zero on success, but actually it returns one on success. This commit fixes this return code check so that a CRL can be loaded.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
When specifying a CRL through the
crl_path
option in the API listener configuration, starting Icinga2 fails with the following error message:The reason for this error message is that
AddCRLToSSLContext
inlib/base/tlsutility.cpp
incorrectly verifies the return code of the OpenSSL functionX509_LOOKUP_load_file
. OpenSSL signals successful execution with a return code of one, but the code inAddCRLToSSLContext
fails if the return code is not zero. This means that the code will not continue when the CRL has actually been loaded successfully, but it will continue when there is an error while loading the CRL.I found this bug in Icinga 2.4, but it is still present in the current master branch.
Don't bother fixing this bug. I already have a patch and will submit a pull request shortly. This issue is only for tracking the bug.
The text was updated successfully, but these errors were encountered: