From: William Lallemand <wlallemand@haproxy.org>
Date: Thu, 30 Dec 2021 13:45:19 +0000 (+0100)
Subject: BUG/MEDIUM: ssl: free the ckch instance linked to a server
X-Git-Tag: v2.6-dev1~210
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=e69563fd8ed1a492ae4547451935908c0802e2c4;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: ssl: free the ckch instance linked to a server

This patch unlinks and frees the ckch instance linked to a server during
the free of this server.

This could have locked certificates in a "Used" state when removing
servers dynamically from the CLI. And could provoke a segfault once we
try to dynamically update the certificate after that.

This must be backported as far as 2.4.
---

diff --git a/src/ssl_sock.c b/src/ssl_sock.c
index 810560b527..47bbf1da1c 100644
--- a/src/ssl_sock.c
+++ b/src/ssl_sock.c
@@ -5247,6 +5247,8 @@ void ssl_sock_free_srv_ctx(struct server *srv)
 #ifdef HAVE_SSL_CTX_SET_CIPHERSUITES
 	ha_free(&srv->ssl_ctx.ciphersuites);
 #endif
+	/* If there is a certificate we must unlink the ckch instance */
+	ckch_inst_free(srv->ssl_ctx.inst);
 }
 
 /* Walks down the two trees in bind_conf and frees all the certs. The pointer may