From: William Lallemand <wlallemand@haproxy.com>
Date: Mon, 16 Dec 2024 15:09:38 +0000 (+0100)
Subject: BUG/MINOR: ssl/cli: 'show ssl cert' escape the first '*' of a filename
X-Git-Tag: v3.2-dev2~69
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=2ba4cf541be0e7a0169c072b7250cb0b8f9de4ba;p=thirdparty%2Fhaproxy.git

BUG/MINOR: ssl/cli: 'show ssl cert' escape the first '*' of a filename

When doing a 'show ssl cert <filename>', prefixing a filename with a '*'
allows to show the uncommited transaction asociated to this filename.

However for people using '*' as the first character of their filename,
there is no way to access this filename.

This patch fixes the problem by allowing to escape the first character
with \.

This should be backported in every stable branches.
---

diff --git a/doc/management.txt b/doc/management.txt
index c3ecd3af07..12d3788227 100644
--- a/doc/management.txt
+++ b/doc/management.txt
@@ -3572,14 +3572,15 @@ show ssl ca-file [<cafile>[:<index>]]
     Serial: 587A1CE5ED855040A0C82BF255FF300ADB7C8136
     [...]
 
-show ssl cert [<filename>]
+show ssl cert [[*][\]<filename>]
   Display the list of certificates loaded into the process. They are not used
   by any frontend or backend until their status is "Used".
   If a filename is prefixed by an asterisk, it is a transaction which is not
   committed yet. If a filename is specified, it will show details about the
   certificate. This command can be useful to check if a certificate was well
   updated. You can also display details on a transaction by prefixing the
-  filename by an asterisk.
+  filename by a '*'. If the first character of the filename is a '*', it can be
+  escaped with '\*'.
   This command can also be used to display the details of a certificate's OCSP
   response by suffixing the filename with a ".ocsp" extension. It works for
   committed certificates as well as for ongoing transactions. On a committed
@@ -3611,6 +3612,11 @@ show ssl cert [<filename>]
     Status: Unused
     [...]
 
+    $ echo "@1 show ssl cert \*.local.pem" | socat /var/run/haproxy.master -
+    Filename: *.local.pem
+    Status: Used
+    [...]
+
 show ssl crl-file [<crlfile>[:<index>]]
   Display the list of CRL files loaded into the process. They are not used
   by any frontend or backend until their status is "Used".
diff --git a/src/ssl_ckch.c b/src/ssl_ckch.c
index 4b12f25655..869b4a2d13 100644
--- a/src/ssl_ckch.c
+++ b/src/ssl_ckch.c
@@ -2203,7 +2203,7 @@ yield:
 #endif
 }
 
-/* parsing function for 'show ssl cert [certfile]' */
+/* parsing function for 'show ssl cert [[*][\]<certfile>]' */
 static int cli_parse_show_cert(char **args, char *payload, struct appctx *appctx, void *private)
 {
 	struct show_cert_ctx *ctx = applet_reserve_svcctx(appctx, sizeof(*ctx));
@@ -2232,17 +2232,27 @@ static int cli_parse_show_cert(char **args, char *payload, struct appctx *appctx
 		}
 
 		if (*args[3] == '*') {
+			char *filename = args[3]+1;
+
 			from_transaction = 1;
 			if (!ckchs_transaction.new_ckchs)
 				goto error;
 
 			ckchs = ckchs_transaction.new_ckchs;
 
-			if (strcmp(args[3] + 1, ckchs->path) != 0)
+			if (filename[0] == '\\')
+				filename++;
+
+			if (strcmp(filename, ckchs->path) != 0)
 				goto error;
 
 		} else {
-			if ((ckchs = ckchs_lookup(args[3])) == NULL)
+			char *filename = args[3];
+
+			if (filename[0] == '\\')
+				filename++;
+
+			if ((ckchs = ckchs_lookup(filename)) == NULL)
 				goto error;
 
 		}