mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2026-05-04 20:46:11 +02:00
Code Issues Projects Releases Wiki Activity

BUG/MINOR: ssl/cli: ocsp_issuer must be set w/ "set ssl cert"

Browse Source 
ocsp_issuer is primary set from ckch->chain when PEM is loaded from file,
but not set when PEM is loaded via CLI payload. Set ckch->ocsp_issuer in
ssl_sock_load_pem_into_ckch to fix that.

Should be backported in 2.1.
This commit is contained in:
Emmanuel Hocdet 2020-01-22 17:02:53 +01:00 committed by William Lallemand
parent a8a415d31a
commit 078156d063
1 changed files with 11 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
src/ssl_sock.c
View File

@ -3274,6 +3274,7 @@ static int ssl_sock_load_pem_into_ckch(const char *path, char *buf, struct cert_
{
BIO *in = NULL;
int ret = 1;
int i;
X509 *ca;
X509 *cert = NULL;
EVP_PKEY *key = NULL;
@ -3387,6 +3388,15 @@ static int ssl_sock_load_pem_into_ckch(const char *path, char *buf, struct cert_
SWAP(ckch->cert, cert);
SWAP(ckch->chain, chain);
/* check if one of the certificate of the chain is the issuer */
for (i = 0; i < sk_X509_num(ckch->chain); i++) {
X509 *issuer = sk_X509_value(ckch->chain, i);
if (X509_check_issued(issuer, ckch->cert) == X509_V_OK) {
ckch->ocsp_issuer = issuer;
X509_up_ref(issuer);
break;
}
}
ret = 0;
end:
@ -3464,22 +3474,8 @@ static int ssl_sock_load_files_into_ckch(const char *path, struct cert_key_and_c
#ifndef OPENSSL_IS_BORINGSSL /* Useless for BoringSSL */
if (ckch->ocsp_response) {
X509 *issuer;
int i;
/* check if one of the certificate of the chain is the issuer */
for (i = 0; i < sk_X509_num(ckch->chain); i++) {
issuer = sk_X509_value(ckch->chain, i);
if (X509_check_issued(issuer, ckch->cert) == X509_V_OK) {
ckch->ocsp_issuer = issuer;
X509_up_ref(ckch->ocsp_issuer);
break;
} else
issuer = NULL;
}
/* if no issuer was found, try to load an issuer from the .issuer */
if (!issuer) {
if (!ckch->ocsp_issuer) {
struct stat st;
char fp[MAXPATHLEN+1];