MINOR: jwt: Do not look into ckch_store for jwt_verify converter

We must not try to load full-on certificates for 'jwt_verify' converter
anymore. 'jwt_verify_cert' is the only one that accepts a certificate.

diff --git a/include/haproxy/jwt.h b/include/haproxy/jwt.h
index 4d0c92b0261b8c1fe28430cf8b8633474a69d6ab..10e928cefd8364946bd8279b72505b1ced5b79b0 100644 (file)
--- a/include/haproxy/jwt.h
+++ b/include/haproxy/jwt.h
@@ -28,7 +28,7 @@
 #ifdef USE_OPENSSL
 enum jwt_alg jwt_parse_alg(const char *alg_str, unsigned int alg_len);
 int jwt_tokenize(const struct buffer *jwt, struct jwt_item *items, unsigned int *item_num);
-int jwt_tree_load_cert(char *path, int pathlen, const char *file, int line, char **err);
+int jwt_tree_load_cert(char *path, int pathlen, int tryload_cert, const char *file, int line, char **err);
 
 enum jwt_vrfy_status jwt_verify(const struct buffer *token, const struct buffer *alg,
                                const struct buffer *key, int is_x509);

diff --git a/src/jwt.c b/src/jwt.c
index d804764054698c03602bf15f781a45b5920f8ad7..ed9680d2190d1ec63d942614224268ed089716a1 100644 (file)
--- a/src/jwt.c
+++ b/src/jwt.c
@@ -133,7 +133,7 @@ int jwt_tokenize(const struct buffer *jwt, struct jwt_item *items, unsigned int
  * Parse a public certificate and insert it into the jwt_cert_tree.
  * Returns 0 in case of success.
  */
-int jwt_tree_load_cert(char *path, int pathlen, const char *file, int line, char **err)
+int jwt_tree_load_cert(char *path, int pathlen, int tryload_cert, const char *file, int line, char **err)
 {
        int retval = -1;
        struct jwt_cert_tree_entry *entry = NULL;
@@ -182,6 +182,9 @@ int jwt_tree_load_cert(char *path, int pathlen, const char *file, int line, char
                }
        }
 
+       if (!tryload_cert)
+               goto end;
+
        /* Look for an actual certificate or crt-store with the given name.
         * If the path corresponds to an actual certificate that was not loaded
         * yet we will create the corresponding ckch_store. */

diff --git a/src/sample.c b/src/sample.c
index e3711c1a7c022fd4303f0910f2d12e7820a391da..78614d846cfcc78e7ecfd2d67c1b156782a11c8a 100644 (file)
--- a/src/sample.c
+++ b/src/sample.c
@@ -4526,7 +4526,7 @@ static int sample_conv_jwt_verify_check(struct arg *args, struct sample_conv *co
                                break;
                        default:
                                retval = (jwt_tree_load_cert(args[1].data.str.area, args[1].data.str.data,
-                                                            file, line, err) == 0);
+                                                            0, file, line, err) == 0);
                                /* The second arg might be an HMAC secret but
                                 * the 'alg' is stored in a var */
                                if (!retval && args[0].type == ARGT_VAR)
@@ -4573,7 +4573,7 @@ static int sample_conv_jwt_verify_cert_check(struct arg *args, struct sample_con
                                break;
                        default:
                                retval = (jwt_tree_load_cert(args[1].data.str.area, args[1].data.str.data,
-                                                            file, line, err) == 0);
+                                                            1, file, line, err) == 0);
                                break;
                }
        } else if (args[1].type == ARGT_VAR) {