The key type checks which are used to optimize the loading of DH and
ECDH parameters should check the type of the supplied server key, not
the global options key.
The code in pxy_ossl_servername_cb() which generated the forged
certificates did not call SSL_CTX_free() on the newly allocated SSL_CTX
struct after associating it with the SSL struct, which increments the
reference count internally. Also add some comments explaining OpenSSL
reference counting behaviour to be more explicit on what happens to the
instances that OpenSSL keeps track of.
When using passthrough mode, if a connection to a server fails with an
SSL error, sslsplit falls back to plain TCP passthrough. When
reconnecting with plain TCP, the SSL context was freed, but the file
descriptor was never closed. The fix remedies that by calling the
proper cleanup function for the dst bev before reconnecting.
Reported by: Peter Haag
Remove a superfluous call to SSL_CTX_free() which caused SSL_CTX
structures to be free'd twice under some circumstances.
Issue: #16
Reported by: Amit Chowdhary
This removes the spurious "Unknown bufferevent 0x80" debug message but
does not have any change in functionality, since return would have been
called anyway after falling down the debug message.
While here, remove the useless "ignoring event" debug message unless
DEBUG_PROXY is defined, and also print the timeout flag in debug mode.
Always explicitly name which arguments are non-null, even if all
arguments are non-null. This is to avoid bugs where newly added
arguments are automatically non-null by accident, possibly leading to
optimisation errors.
This also fixes a few potential errors related to non-null arguments;
specifically it prevents the compiler optimising away a test for sni
being NULL in cachedsess_mkkey().
Issue: #14
Reported by: kythyria
Properly reset connection state when reconnecting the dst part of the
connection. This fixes the fallback to passthrough when no certficates
are present which can be used to split the SSL.
Issue: #9
Reported by: ceear
