BUG/MEDIUM: ssl/cli: abort ssl cert is freeing the old store

The "abort ssl cert" command is buggy and removes the current ckch store,
and instances, leading to SNI removal. It must only removes the new one.

This patch also adds a check in set_ssl_cert.vtc and
set_ssl_server_cert.vtc.

Must be backported as far as 2.2.

diff --git a/reg-tests/ssl/set_ssl_cert.vtc b/reg-tests/ssl/set_ssl_cert.vtc
index 0e84058baa71e8b0be57bfbb58132adcfc9cbaa4..d6d45261f9d1bf113ee9b532e5b586e1b0bb9c17 100644 (file)
--- a/reg-tests/ssl/set_ssl_cert.vtc
+++ b/reg-tests/ssl/set_ssl_cert.vtc
@@ -86,3 +86,14 @@ client c1 -connect ${h1_clearlst_sock} {
     rxresp
     expect resp.status == 200
 } -run
+
+shell {
+    printf "set ssl cert ${testdir}/common.pem <<\n$(cat ${testdir}/common.pem)\n\n" | socat "${tmpdir}/h1/stats" -
+    echo "abort ssl cert ${testdir}/common.pem" | socat "${tmpdir}/h1/stats" -
+}
+
+haproxy h1 -cli {
+    send "show ssl cert ${testdir}/common.pem"
+    expect ~ ".*SHA1 FingerPrint: A490D069DBAFBEE66DE434BEC34030ADE8BCCBF1"
+}
+

diff --git a/reg-tests/ssl/set_ssl_server_cert.vtc b/reg-tests/ssl/set_ssl_server_cert.vtc
index cab2d042853c8d3d0b419a189f9e6a049b42da19..412e9f05bd7218fe776cc51b59352f7ed2ce5a7b 100644 (file)
--- a/reg-tests/ssl/set_ssl_server_cert.vtc
+++ b/reg-tests/ssl/set_ssl_server_cert.vtc
@@ -108,3 +108,23 @@ client c1 -connect ${h1_clearlst_sock} {
     expect resp.http.x-ssl == "Revoked"
 } -run
 
+# Abort a transaction
+shell {
+    printf "set ssl cert ${testdir}/client1.pem <<\n$(cat ${testdir}/client3_revoked.pem)\n\n" | socat "${tmpdir}/h1/stats" -
+    echo "abort ssl cert ${testdir}/client1.pem" | socat "${tmpdir}/h1/stats" -
+}
+
+haproxy h1 -cli {
+    send "show ssl cert ${testdir}/client1.pem"
+    expect ~ ".*SHA1 FingerPrint: 992386628A40C9D49C89BAC0058B5D45D8575151"
+}
+
+# The certificate was not updated so it should still be revoked
+client c1 -connect ${h1_clearlst_sock} {
+    txreq
+    rxresp
+    expect resp.status == 200
+    expect resp.http.x-ssl == "Revoked"
+} -run
+
+

diff --git a/src/ssl_ckch.c b/src/ssl_ckch.c
index 62e7b4475b733c978391823966d43db75d79abf8..e8a20c38d34f1997cca5c8855de50529c5e0597d 100644 (file)
--- a/src/ssl_ckch.c
+++ b/src/ssl_ckch.c
@@ -1742,7 +1742,6 @@ static int cli_parse_abort_cert(char **args, char *payload, struct appctx *appct
        /* Only free the ckchs there, because the SNI and instances were not generated yet */
        ckch_store_free(ckchs_transaction.new_ckchs);
        ckchs_transaction.new_ckchs = NULL;
-       ckch_store_free(ckchs_transaction.old_ckchs);
        ckchs_transaction.old_ckchs = NULL;
        free(ckchs_transaction.path);
        ckchs_transaction.path = NULL;