mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2025-08-06 15:17:01 +02:00
Code Issues Projects Releases Wiki Activity

BUG/MINOR: ssl/cli: 'show ssl ca-file' escape the first '*' of a filename

Browse Source 
When doing a 'show ssl ca-file <filename>', prefixing a filename with a '*'
allows to show the uncommited transaction asociated to this filename.

However for people using '*' as the first character of their
filename, there is no way to access this filename.

This patch fixes the problem by allowing to escape the first
character with \.

This should be backported in every stable branches.
This commit is contained in:
William Lallemand 2024-12-16 17:04:25 +01:00
parent 82c83a11a1
commit e3b760ebcc
2 changed files with 15 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
doc/management.txt
View File

@ -3523,7 +3523,7 @@ show stat [domain <resolvers|proxy>] [{<iid>|<proxy>} <type> <sid>] \
$ echo "show stat json" | socat /var/run/haproxy.sock stdio | \
python -m json.tool
show ssl ca-file [<cafile>[:<index>]]
show ssl ca-file [[*][\]<cafile>[:<index>]]
Display the list of CA files loaded into the process and their respective
certificate counts. The certificates are not used by any frontend or backend
until their status is "Used".
@ -3540,7 +3540,8 @@ show ssl ca-file [<cafile>[:<index>]]
If the index is invalid (too big for instance), nothing will be displayed.
This command can be useful to check if a CA file was properly updated.
You can also display the details of an ongoing transaction by prefixing the
filename by an asterisk.
filename by a '*'. If the first character of the filename is a '*', it can be
escaped with '\*'.
Example :

15
src/ssl_ckch.c
View File

@ -3584,7 +3584,7 @@ static int cli_io_handler_show_cafile_detail(struct appctx *appctx)
}
/* parsing function for 'show ssl ca-file [cafile[:index]]'.
/* parsing function for 'show ssl ca-file [[*][\]<cafile>[:index]]'.
* It prepares a show_cafile_ctx context, and checks the global
* cafile_transaction under the ckch_lock (read only).
*/
@ -3626,18 +3626,27 @@ static int cli_parse_show_cafile(char **args, char *payload, struct appctx *appc
}
if (*args[3] == '*') {
char *filename = args[3]+1;
if (filename[0] == '\\')
filename++;
if (!cafile_transaction.new_cafile_entry)
goto error;
cafile_entry = cafile_transaction.new_cafile_entry;
if (strcmp(args[3] + 1, cafile_entry->path) != 0)
if (strcmp(filename, cafile_entry->path) != 0)
goto error;
} else {
char *filename = args[3];
if (filename[0] == '\\')
filename++;
/* Get the "original" cafile_entry and not the
* uncommitted one if it exists. */
if ((cafile_entry = ssl_store_get_cafile_entry(args[3], 1)) == NULL || cafile_entry->type != CAFILE_CERT)
if ((cafile_entry = ssl_store_get_cafile_entry(filename, 1)) == NULL || cafile_entry->type != CAFILE_CERT)
goto error;
}