mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2025-08-07 15:47:01 +02:00
Code Issues Projects Releases Wiki Activity

MINOR: peers: Add a warning about incompatible SSL config for the local peer

Browse Source 
In peers section, it is possible to enable SSL for the local peer. In this
case, the bind line and the server line should both be configured. A
"default-server" directive may also be used to configure the SSL on the
server side. However there is no test to be sure the SSL is enabled on both
sides. It is an problem because the local resync performed during a reload
will be impossible and it is probably not the expected behavior.

So, it is now checked during the configuration validation. A warning message
is displayed if the SSL is not properly configured for the local peer.

This patch is related to issue #1799. It should probably be backported to 2.6.
This commit is contained in:
Christopher Faulet 2022-07-26 19:03:51 +02:00
parent bd6ec1bf84
commit 1b6fa7f5ea
1 changed files with 11 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
src/cfgparse.c
View File

@ -4097,6 +4097,17 @@ int check_config_validity()
l = &curpeers->peers_fe->conf.bind;
bind_conf = LIST_ELEM(l->n, typeof(bind_conf), by_fe);
if (curpeers->local->srv) {
if (curpeers->local->srv->use_ssl == 1 && !(bind_conf->options & BC_O_USE_SSL)) {
ha_warning("Peers section '%s': local peer have a non-SSL listener and a SSL server configured at line %s:%d.\n",
curpeers->peers_fe->id, curpeers->local->conf.file, curpeers->local->conf.line);
}
else if (curpeers->local->srv->use_ssl != 1 && (bind_conf->options & BC_O_USE_SSL)) {
ha_warning("Peers section '%s': local peer have a SSL listener and a non-SSL server configured at line %s:%d.\n",
curpeers->peers_fe->id, curpeers->local->conf.file, curpeers->local->conf.line);
}
}
err = NULL;
if (thread_resolve_group_mask(bind_conf->bind_tgroup, bind_conf->bind_thread,
&bind_conf->bind_tgroup, &bind_conf->bind_thread, &err) < 0) {