]> git.ipfire.org Git - thirdparty/haproxy.git/commit
BUG/MINOR: ssl: Prevent disk access when using "add ssl crt-list"
authorRemi Tricot-Le Breton <rlebreton@haproxy.com>
Tue, 23 Mar 2021 15:41:53 +0000 (16:41 +0100)
committerWilliam Lallemand <wlallemand@haproxy.org>
Tue, 23 Mar 2021 18:29:46 +0000 (19:29 +0100)
commitfb00f31af4ba67c69a12807729514a2bdcd47efa
tree65c50f8ffc6a5c06ab30e5ff82974f8d146a10c8
parentf23b1bc53484d6a63edc5595caf1ab8f354e1288
BUG/MINOR: ssl: Prevent disk access when using "add ssl crt-list"

If an unknown CA file was first mentioned in an "add ssl crt-list" CLI
command, it would result in a call to X509_STORE_load_locations which
performs a disk access which is forbidden during runtime. The same would
happen if a "ca-verify-file" or "crl-file" was specified. This was due
to the fact that the crt-list file parsing and the crt-list related CLI
commands parsing use the same functions.
The patch simply adds a new parameter to all the ssl_bind parsing
functions so that they know if the call is made during init or by the
CLI, and the ssl_store_load_locations function can then reject any new
cafile_entry creation coming from a CLI call.

It can be backported as far as 2.2.
include/haproxy/listener-t.h
include/haproxy/ssl_crtlist.h
include/haproxy/ssl_sock.h
reg-tests/ssl/add_ssl_crt-list.vtc
src/cfgparse-ssl.c
src/ssl_crtlist.c
src/ssl_sock.c