Merge pull request #191 from emqx/fast_fail_on_invalid_ssl_opts

fix: fast fail on invalid ssl options
emqx · Aug 5, 2024 · 81f4223 · 81f4223
2 parents 7e9e98f + 6b911b8
commit 81f4223
Show file tree

Hide file tree

Showing 3 changed files with 10 additions and 5 deletions.
diff --git a/src/esockd.app.src b/src/esockd.app.src
@@ -1,7 +1,7 @@
 {application, esockd,
  [{description, "General Non-blocking TCP/SSL and UDP/DTLS Server"},
   {id, "esockd"},
-  {vsn, "5.9.7"},
+  {vsn, git},
   {modules, []},
   {registered, []},
   {applications, [kernel, stdlib, sasl, ssl, public_key]},

diff --git a/src/esockd_acceptor_sup.erl b/src/esockd_acceptor_sup.erl
@@ -126,7 +126,11 @@ ssl_upgrade_fun(Type, Opts) ->
           end,
     case proplists:get_value(Key, Opts) of
         undefined -> [];
-        SslOpts -> [esockd_transport:ssl_upgrade_fun(SslOpts)]
+        SslOpts ->
+            %% validate ssl options and prevent the listener from starting if
+            %% validation failed
+            _ = ssl:handle_options(SslOpts, server, undefined),
+            [esockd_transport:ssl_upgrade_fun(SslOpts)]
     end.
 
 tune_socket(Sock, []) ->

diff --git a/test/esockd_SUITE.erl b/test/esockd_SUITE.erl
@@ -404,9 +404,10 @@ t_update_tls_options(Config) ->
                               [{ssl_options, SslOpts1}, {connection_mfargs, echo_server}]),
     {ok, Sock1} = ssl:connect("localhost", LPort, ClientSslOpts, 1000),
 
-    ok = esockd:set_options({echo_tls, LPort}, [{ssl_options, [{verify, verify_peer}]}]),
-    ?assertEqual( {error, closed}
-                , ssl:connect("localhost", LPort, ClientSslOpts, 1000)),
+    ?assertError(
+        {badmatch, _},
+        esockd:set_options({echo_tls, LPort}, [{ssl_options, [{verify, verify_peer}]}])
+    ),
 
     ok = esockd:set_options({echo_tls, LPort}, [{ssl_options, SslOpts2}]),
     {ok, Sock2} = ssl:connect("localhost", LPort, ClientSslOpts, 1000),