mirror of
https://git.haproxy.org/git/haproxy.git/
synced 2025-11-25 21:01:09 +01:00
This patch fixes an issue in the "-dK" keywords dumper, which was
mistakenly displaying the "crt-list" keywords for "bind ssl" keywords.
The patch fixes the issue by dumping the "crt-list" keywords in its own
section, and dumping the "bind" keywords which are in the "SSL" scope
with a "bind ssl" prefix.
This commit depends on the previous "MINOR: ssl: rename confusing
ssl_bind_kws" commit.
Must be backported in 2.6.
Diff of the `./haproxy -dKall -q -c -f /dev/null` output before and
after the patch in 2.8-dev4:
| @@ -190,30 +190,9 @@ listen
| use-fcgi-app
| bind <addr> accept-netscaler-cip +1
| bind <addr> accept-proxy
| - bind <addr> allow-0rtt
| - bind <addr> alpn +1
| bind <addr> backlog +1
| - bind <addr> ca-file +1
| - bind <addr> ca-ignore-err +1
| - bind <addr> ca-sign-file +1
| - bind <addr> ca-sign-pass +1
| - bind <addr> ca-verify-file +1
| - bind <addr> ciphers +1
| - bind <addr> ciphersuites +1
| - bind <addr> crl-file +1
| - bind <addr> crt +1
| - bind <addr> crt-ignore-err +1
| - bind <addr> crt-list +1
| - bind <addr> curves +1
| bind <addr> defer-accept
| - bind <addr> ecdhe +1
| bind <addr> expose-fd +1
| - bind <addr> force-sslv3
| - bind <addr> force-tlsv10
| - bind <addr> force-tlsv11
| - bind <addr> force-tlsv12
| - bind <addr> force-tlsv13
| - bind <addr> generate-certificates
| bind <addr> gid +1
| bind <addr> group +1
| bind <addr> id +1
| @@ -225,48 +204,52 @@ listen
| bind <addr> name +1
| bind <addr> namespace +1
| bind <addr> nice +1
| - bind <addr> no-ca-names
| - bind <addr> no-sslv3
| - bind <addr> no-tls-tickets
| - bind <addr> no-tlsv10
| - bind <addr> no-tlsv11
| - bind <addr> no-tlsv12
| - bind <addr> no-tlsv13
| - bind <addr> npn +1
| - bind <addr> prefer-client-ciphers
| bind <addr> process +1
| bind <addr> proto +1
| bind <addr> severity-output +1
| bind <addr> shards +1
| - bind <addr> ssl
| - bind <addr> ssl-max-ver +1
| - bind <addr> ssl-min-ver +1
| - bind <addr> strict-sni
| bind <addr> tcp-ut +1
| bind <addr> tfo
| bind <addr> thread +1
| - bind <addr> tls-ticket-keys +1
| bind <addr> transparent
| bind <addr> uid +1
| bind <addr> user +1
| bind <addr> v4v6
| bind <addr> v6only
| - bind <addr> verify +1
| bind <addr> ssl allow-0rtt
| bind <addr> ssl alpn +1
| bind <addr> ssl ca-file +1
| + bind <addr> ssl ca-ignore-err +1
| + bind <addr> ssl ca-sign-file +1
| + bind <addr> ssl ca-sign-pass +1
| bind <addr> ssl ca-verify-file +1
| bind <addr> ssl ciphers +1
| bind <addr> ssl ciphersuites +1
| bind <addr> ssl crl-file +1
| + bind <addr> ssl crt +1
| + bind <addr> ssl crt-ignore-err +1
| + bind <addr> ssl crt-list +1
| bind <addr> ssl curves +1
| bind <addr> ssl ecdhe +1
| + bind <addr> ssl force-sslv3
| + bind <addr> ssl force-tlsv10
| + bind <addr> ssl force-tlsv11
| + bind <addr> ssl force-tlsv12
| + bind <addr> ssl force-tlsv13
| + bind <addr> ssl generate-certificates
| bind <addr> ssl no-ca-names
| + bind <addr> ssl no-sslv3
| + bind <addr> ssl no-tls-tickets
| + bind <addr> ssl no-tlsv10
| + bind <addr> ssl no-tlsv11
| + bind <addr> ssl no-tlsv12
| + bind <addr> ssl no-tlsv13
| bind <addr> ssl npn +1
| - bind <addr> ssl ocsp-update +1
| + bind <addr> ssl prefer-client-ciphers
| bind <addr> ssl ssl-max-ver +1
| bind <addr> ssl ssl-min-ver +1
| + bind <addr> ssl strict-sni
| + bind <addr> ssl tls-ticket-keys +1
| bind <addr> ssl verify +1
| server <name> <addr> addr +1
| server <name> <addr> agent-addr +1
| @@ -591,6 +574,23 @@ listen
| http-after-response unset-var*
| userlist
| peers
| +crt-list
| + allow-0rtt
| + alpn +1
| + ca-file +1
| + ca-verify-file +1
| + ciphers +1
| + ciphersuites +1
| + crl-file +1
| + curves +1
| + ecdhe +1
| + no-ca-names
| + npn +1
| + ocsp-update +1
| + ssl-max-ver +1
| + ssl-min-ver +1
| + verify +1
| # List of registered CLI keywords:
| @!<pid> [MASTER]
| @<relative pid> [MASTER]
149 lines
5.9 KiB
C
149 lines
5.9 KiB
C
/*
|
|
* include/haproxy/cfgparse.h
|
|
* Configuration parsing functions.
|
|
*
|
|
* Copyright (C) 2000-2020 Willy Tarreau - w@1wt.eu
|
|
*
|
|
* This library is free software; you can redistribute it and/or
|
|
* modify it under the terms of the GNU Lesser General Public
|
|
* License as published by the Free Software Foundation, version 2.1
|
|
* exclusively.
|
|
*
|
|
* This library is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
* Lesser General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU Lesser General Public
|
|
* License along with this library; if not, write to the Free Software
|
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
|
|
*/
|
|
|
|
#ifndef _HAPROXY_CFGPARSE_H
|
|
#define _HAPROXY_CFGPARSE_H
|
|
|
|
#include <haproxy/api.h>
|
|
|
|
struct hap_cpuset;
|
|
struct proxy;
|
|
struct bind_conf;
|
|
struct acl_cond;
|
|
|
|
/* configuration sections */
|
|
#define CFG_NONE 0
|
|
#define CFG_GLOBAL 1
|
|
#define CFG_LISTEN 2
|
|
#define CFG_USERLIST 3
|
|
#define CFG_PEERS 4
|
|
#define CFG_CRTLIST 5
|
|
|
|
/* various keyword modifiers */
|
|
enum kw_mod {
|
|
KWM_STD = 0, /* normal */
|
|
KWM_NO, /* "no" prefixed before the keyword */
|
|
KWM_DEF, /* "default" prefixed before the keyword */
|
|
};
|
|
|
|
enum cfg_keyword_flags {
|
|
KWF_EXPERIMENTAL = 0x1,
|
|
KWF_MATCH_PREFIX = 0x2,
|
|
};
|
|
|
|
struct cfg_keyword {
|
|
int section; /* section type for this keyword */
|
|
const char *kw; /* the keyword itself */
|
|
int (*parse)( /* 0=OK, <0=Alert, >0=Warning */
|
|
char **args, /* command line and arguments */
|
|
int section_type, /* current section CFG_{GLOBAL|LISTEN} */
|
|
struct proxy *curpx, /* current proxy (NULL in GLOBAL) */
|
|
const struct proxy *defpx, /* default proxy (NULL in GLOBAL) */
|
|
const char *file, /* config file name */
|
|
int line, /* config file line number */
|
|
char **err); /* error or warning message output pointer */
|
|
int flags;
|
|
};
|
|
|
|
/* A keyword list. It is a NULL-terminated array of keywords. It embeds a
|
|
* struct list in order to be linked to other lists, allowing it to easily
|
|
* be declared where it is needed, and linked without duplicating data nor
|
|
* allocating memory.
|
|
*/
|
|
struct cfg_kw_list {
|
|
struct list list;
|
|
struct cfg_keyword kw[VAR_ARRAY];
|
|
};
|
|
|
|
/* permit to store configuration section */
|
|
struct cfg_section {
|
|
struct list list;
|
|
char *section_name;
|
|
int (*section_parser)(const char *, int, char **, int);
|
|
int (*post_section_parser)();
|
|
};
|
|
|
|
/* store post configuration parsing */
|
|
|
|
struct cfg_postparser {
|
|
struct list list;
|
|
char *name;
|
|
int (*func)();
|
|
};
|
|
|
|
extern struct list postparsers;
|
|
extern int cfg_maxpconn;
|
|
extern int cfg_maxconn;
|
|
extern char *cfg_scope;
|
|
extern struct cfg_kw_list cfg_keywords;
|
|
extern char *cursection;
|
|
extern int non_global_section_parsed;
|
|
|
|
int cfg_parse_global(const char *file, int linenum, char **args, int inv);
|
|
int cfg_parse_listen(const char *file, int linenum, char **args, int inv);
|
|
int cfg_parse_track_sc_num(unsigned int *track_sc_num,
|
|
const char *arg, const char *end, char **err);
|
|
int readcfgfile(const char *file);
|
|
void cfg_register_keywords(struct cfg_kw_list *kwl);
|
|
void cfg_unregister_keywords(struct cfg_kw_list *kwl);
|
|
int check_config_validity(void);
|
|
int str2listener(char *str, struct proxy *curproxy, struct bind_conf *bind_conf, const char *file, int line, char **err);
|
|
int str2receiver(char *str, struct proxy *curproxy, struct bind_conf *bind_conf, const char *file, int line, char **err);
|
|
int cfg_register_section(char *section_name,
|
|
int (*section_parser)(const char *, int, char **, int),
|
|
int (*post_section_parser)());
|
|
int cfg_register_postparser(char *name, int (*func)());
|
|
void cfg_unregister_sections(void);
|
|
void cfg_backup_sections(struct list *backup_sections);
|
|
void cfg_restore_sections(struct list *backup_sections);
|
|
int warnif_misplaced_tcp_conn(struct proxy *proxy, const char *file, int line, const char *arg);
|
|
int warnif_misplaced_tcp_sess(struct proxy *proxy, const char *file, int line, const char *arg);
|
|
int warnif_misplaced_tcp_cont(struct proxy *proxy, const char *file, int line, const char *arg);
|
|
int warnif_cond_conflicts(const struct acl_cond *cond, unsigned int where, const char *file, int line);
|
|
int warnif_tcp_http_cond(const struct proxy *px, const struct acl_cond *cond);
|
|
int too_many_args_idx(int maxarg, int index, char **args, char **msg, int *err_code);
|
|
int too_many_args(int maxarg, char **args, char **msg, int *err_code);
|
|
int alertif_too_many_args_idx(int maxarg, int index, const char *file, int linenum, char **args, int *err_code);
|
|
int alertif_too_many_args(int maxarg, const char *file, int linenum, char **args, int *err_code);
|
|
int parse_process_number(const char *arg, unsigned long *proc, int max, int *autoinc, char **err);
|
|
unsigned long parse_cpu_set(const char **args, struct hap_cpuset *cpu_set, int comma_allowed, char **err);
|
|
void free_email_alert(struct proxy *p);
|
|
const char *cfg_find_best_match(const char *word, const struct list *list, int section, const char **extra);
|
|
int warnifnotcap(struct proxy *proxy, int cap, const char *file, int line, const char *arg, const char *hint);
|
|
int failifnotcap(struct proxy *proxy, int cap, const char *file, int line, const char *arg, const char *hint);
|
|
void cfg_dump_registered_keywords();
|
|
|
|
/* simplified way to define a section parser */
|
|
#define REGISTER_CONFIG_SECTION(name, parse, post) \
|
|
INITCALL3(STG_REGISTER, cfg_register_section, (name), (parse), (post))
|
|
|
|
#define REGISTER_CONFIG_POSTPARSER(name, parser) \
|
|
INITCALL2(STG_REGISTER, cfg_register_postparser, (name), (parser))
|
|
|
|
#endif /* _HAPROXY_CFGPARSE_H */
|
|
|
|
/*
|
|
* Local variables:
|
|
* c-indent-level: 8
|
|
* c-basic-offset: 8
|
|
* End:
|
|
*/
|