BUG/MINOR: ssl: copy curves, sigalgs and client_sigalgs in srv_ssl_settings_cpy()

When a server inherits SSL settings from default-server, the curves,
sigalgs and client_sigalgs fields were not copied despite being
allocated by ssl-default-server-* keywords. This causes use-after-free
when the original ssl_ctx is destroyed while another reference still
holds the pointer.

Add strdup() calls guarded by the same OpenSSL API version checks
used elsewhere in the copy function.

Fixes issue #3506.

This change is should be backported to all supported branches.

diff --git a/src/server.c b/src/server.c
index f8fa20cb85a561e229a891385bd77d86f7f48962..8cd97b9784fe84f70f76a431b2ad9c4ef66ab688 100644 (file)
--- a/src/server.c
+++ b/src/server.c
@@ -2777,6 +2777,18 @@ static void srv_ssl_settings_cpy(struct server *srv, const struct server *src)
                srv->ssl_ctx.verify_host = strdup(src->ssl_ctx.verify_host);
        if (src->ssl_ctx.ciphers != NULL)
                srv->ssl_ctx.ciphers = strdup(src->ssl_ctx.ciphers);
+#if defined(SSL_CTX_set1_curves_list)
+       if (src->ssl_ctx.curves != NULL)
+               srv->ssl_ctx.curves = strdup(src->ssl_ctx.curves);
+#endif
+#if defined(SSL_CTX_set1_sigalgs_list)
+       if (src->ssl_ctx.sigalgs != NULL)
+               srv->ssl_ctx.sigalgs = strdup(src->ssl_ctx.sigalgs);
+#endif
+#if defined(SSL_CTX_set1_client_sigalgs_list)
+       if (src->ssl_ctx.client_sigalgs != NULL)
+               srv->ssl_ctx.client_sigalgs = strdup(src->ssl_ctx.client_sigalgs);
+#endif
        if (src->ssl_ctx.options)
                srv->ssl_ctx.options = src->ssl_ctx.options;
        if (src->ssl_ctx.methods.flags)