Initialise TLS *ONCE* in main, don't reinitialise it every time a new ctx is created.

Late initialisation was causing the PostgreSQL driver to fail with rlm_sql_postgresql: Connection failed: could not create SSL context: SSL error code 336236705

diff --git a/src/include/tls-h b/src/include/tls-h
index 81d70ee..cc2413f 100644 (file)
--- a/src/include/tls-h
+++ b/src/include/tls-h
@@ -293,7 +293,8 @@ void                cbtls_msg(int write_p, int msg_version, int content_type, void const *buf
 int            cbtls_verify(int ok, X509_STORE_CTX *ctx);
 
 /* TLS */
-tls_session_t *tls_new_session(fr_tls_server_conf_t *conf, REQUEST *request,
+void           tls_global_init(void);
+tls_session_t  *tls_new_session(fr_tls_server_conf_t *conf, REQUEST *request,
                               int client_cert);
 tls_session_t  *tls_new_client_session(fr_tls_server_conf_t *conf, int fd);
 fr_tls_server_conf_t *tls_server_conf_parse(CONF_SECTION *cs);

diff --git a/src/main/radiusd.c b/src/main/radiusd.c
index e4aaac9..f18e982 100644 (file)
--- a/src/main/radiusd.c
+++ b/src/main/radiusd.c
@@ -294,6 +294,12 @@ int main(int argc, char *argv[])
        if (ssl_check_version() < 0) {
                exit(EXIT_FAILURE);
        }
+
+       /*
+        *      Initialising OpenSSL once, here, is safer than having individual
+        *      modules do it.
+        */
+       tls_global_init();
 #endif
 
        if (flag && (flag != 0x03)) {

diff --git a/src/main/tls.c b/src/main/tls.c
index 01d72d6..c32fde5 100644 (file)
--- a/src/main/tls.c
+++ b/src/main/tls.c
@@ -1901,6 +1901,17 @@ static void sess_free_vps(UNUSED void *parent, void *data_ptr,
        pairfree(&vp);
 }
 
+/*
+ *     Add all the default ciphers and message digests
+ *     Create our context.
+ *
+ *     This should be called exactly once from main.
+ */
+void tls_global_init(void)
+{
+       SSL_library_init();
+       SSL_load_error_strings();
+}
 
 /*
  *     Create Global context SSL and use it in every new session
@@ -1918,13 +1929,6 @@ static SSL_CTX *init_tls_ctx(fr_tls_server_conf_t *conf, int client)
        int type;
 
        /*
-        *      Add all the default ciphers and message digests
-        *      Create our context.
-        */
-       SSL_library_init();
-       SSL_load_error_strings();
-
-       /*
         *      SHA256 is in all versions of OpenSSL, but isn't
         *      initialized by default.  It's needed for WiMAX
         *      certificates.