Reuse old SSL key if loading a new one failed

[ngircd-alex.git] / src / ngircd / conn-ssl.c

diff --git a/src/ngircd/conn-ssl.c b/src/ngircd/conn-ssl.c
index be6ee0a8f9490be9dd5a15976d483ab0d9a850d0..3f482dc7ff60263ce40822d41d20c4a7b345e409 100644 (file)
--- a/src/ngircd/conn-ssl.c
+++ b/src/ngircd/conn-ssl.c
@@ -42,6 +42,7 @@ extern struct SSLOptions Conf_SSLOptions;
 #ifdef HAVE_LIBSSL
 #include <openssl/err.h>
 #include <openssl/rand.h>
+#include <openssl/dh.h>
 
 static SSL_CTX * ssl_ctx;
 static DH *dh_params;
@@ -283,10 +284,12 @@ ConnSSL_InitLibrary( void )
 #ifdef HAVE_LIBSSL
        SSL_CTX *newctx;
 
+#if OPENSSL_API_COMPAT < 0x10100000L
        if (!ssl_ctx) {
                SSL_library_init();
                SSL_load_error_strings();
        }
+#endif
 
        if (!RAND_status()) {
                Log(LOG_ERR, "OpenSSL PRNG not seeded: /dev/urandom missing?");
@@ -308,8 +311,18 @@ ConnSSL_InitLibrary( void )
                return false;
        }
 
-       if (!ConnSSL_LoadServerKey_openssl(newctx))
+       if (!ConnSSL_LoadServerKey_openssl(newctx)) {
+               /* Failed to read new key but an old ssl context
+                * already exists -> reuse old context */
+               if (ssl_ctx) {
+                       SSL_CTX_free(newctx);
+                       Log(LOG_WARNING,
+                       "Re-Initializing of SSL failed, using old keys!");
+                       return true;
+               }
+               /* No preexisting old context -> error. */
                goto out;
+       }
 
        if (SSL_CTX_set_cipher_list(newctx, Conf_SSLOptions.CipherList) == 0) {
                Log(LOG_ERR, "Failed to apply OpenSSL cipher list \"%s\"!",
@@ -324,7 +337,7 @@ ConnSSL_InitLibrary( void )
                           Verify_openssl);
        SSL_CTX_free(ssl_ctx);
        ssl_ctx = newctx;
-       Log(LOG_INFO, "%s initialized.", SSLeay_version(SSLEAY_VERSION));
+       Log(LOG_INFO, "%s initialized.", OpenSSL_version(OPENSSL_VERSION));
        return true;
 out:
        SSL_CTX_free(newctx);
@@ -745,7 +758,7 @@ ConnSSL_InitCertFp( CONNECTION *c )
                gnutls_x509_crt_deinit(cert);
                return 0;
        }
-       
+
        if (gnutls_x509_crt_import(cert, &cert_list[0],
                                   GNUTLS_X509_FMT_DER) != GNUTLS_E_SUCCESS) {
                gnutls_x509_crt_deinit(cert);
@@ -912,5 +925,3 @@ ConnSSL_InitLibrary(void)
 
 #endif /* SSL_SUPPORT */
 /* -eof- */
-
-