mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2025-08-06 15:17:01 +02:00
Code Issues Projects Releases Wiki Activity

BUG/MEDIUM: ssl/cli: abort ssl cert is freeing the old store

Browse Source 
The "abort ssl cert" command is buggy and removes the current ckch store,
and instances, leading to SNI removal. It must only removes the new one.

This patch also adds a check in set_ssl_cert.vtc and
set_ssl_server_cert.vtc.

Must be backported as far as 2.2.
This commit is contained in:
William Lallemand 2021-02-01 15:31:00 +01:00
parent 040b1195f7
commit 8695ce0bae
3 changed files with 31 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
reg-tests/ssl/set_ssl_cert.vtc
View File

@ -86,3 +86,14 @@ client c1 -connect ${h1_clearlst_sock} {
rxresp
expect resp.status == 200
} -run
shell {
printf "set ssl cert ${testdir}/common.pem <<\n$(cat ${testdir}/common.pem)\n\n" | socat "${tmpdir}/h1/stats" -
echo "abort ssl cert ${testdir}/common.pem" | socat "${tmpdir}/h1/stats" -
}
haproxy h1 -cli {
send "show ssl cert ${testdir}/common.pem"
expect ~ ".*SHA1 FingerPrint: A490D069DBAFBEE66DE434BEC34030ADE8BCCBF1"
}

20
reg-tests/ssl/set_ssl_server_cert.vtc
View File

@ -108,3 +108,23 @@ client c1 -connect ${h1_clearlst_sock} {
expect resp.http.x-ssl == "Revoked"
} -run
# Abort a transaction
shell {
printf "set ssl cert ${testdir}/client1.pem <<\n$(cat ${testdir}/client3_revoked.pem)\n\n" | socat "${tmpdir}/h1/stats" -
echo "abort ssl cert ${testdir}/client1.pem" | socat "${tmpdir}/h1/stats" -
}
haproxy h1 -cli {
send "show ssl cert ${testdir}/client1.pem"
expect ~ ".*SHA1 FingerPrint: 992386628A40C9D49C89BAC0058B5D45D8575151"
}
# The certificate was not updated so it should still be revoked
client c1 -connect ${h1_clearlst_sock} {
txreq
rxresp
expect resp.status == 200
expect resp.http.x-ssl == "Revoked"
} -run

1
src/ssl_ckch.c
View File

@ -1742,7 +1742,6 @@ static int cli_parse_abort_cert(char **args, char *payload, struct appctx *appct
/* Only free the ckchs there, because the SNI and instances were not generated yet */
ckch_store_free(ckchs_transaction.new_ckchs);
ckchs_transaction.new_ckchs = NULL;
ckch_store_free(ckchs_transaction.old_ckchs);
ckchs_transaction.old_ckchs = NULL;
free(ckchs_transaction.path);
ckchs_transaction.path = NULL;