Only load TLS certificate when the specified file exists and is readable

Signed-off-by: DL6ER <dl6er@dl6er.de>

src/files.c

@@ -80,10 +80,19 @@ bool file_exists(const char *filename)
 		return false;
 	}
 
-	// Check if this is a directory
+	// Check if this is a regular file
 	return S_ISREG(stats.st_mode);
 }
 
+/**
+ * Function to check whether a file exists and is readable or not.
+ */
+bool file_readable(const char *filename)
+{
+	// Check if file exists and is readable
+	return access(filename, R_OK) == 0;
+}
+
 /**
  * Function to check whether a directory exists or not.
  * It returns true if given path is a directory and exists

src/files.h

@@ -20,6 +20,7 @@
 
 bool chmod_file(const char *filename, const mode_t mode);
 bool file_exists(const char *filename);
+bool file_readable(const char *filename);
 bool get_database_stat(struct stat *st);
 unsigned long long get_FTL_db_filesize(void);
 void get_permission_string(char permissions[10], struct stat *st);

src/webserver/webserver.c

@@ -20,6 +20,8 @@
 #include "ph7.h"
 // get_nprocs()
 #include <sys/sysinfo.h>
+// file_readable()
+#include "../files.h"
 
 // Server context handle
 static struct mg_context *ctx = NULL;
@@ -163,10 +165,19 @@ void http_init(void)
 
 #ifdef HAVE_TLS
 	// Add TLS options if configured
-	if(config.webserver.tls_cert.v.s != NULL && strlen(config.webserver.tls_cert.v.s) > 0)
+	if(config.webserver.tls_cert.v.s != NULL &&
+	   strlen(config.webserver.tls_cert.v.s) > 0)
 	{
-		options[++next_option] = "ssl_certificate";
-		options[++next_option] = config.webserver.tls_cert.v.s;
+		if(file_readable(config.webserver.tls_cert.v.s))
+		{
+			options[++next_option] = "ssl_certificate";
+			options[++next_option] = config.webserver.tls_cert.v.s;
+		}
+		else
+		{
+			log_err("Webserver TLS certificate %s not found or not readable!",
+			        config.webserver.tls_cert.v.s);
+		}
 	}
 #endif
 	// Add access control list if configured (last two options)