MEDIUM: ssl: ignore dotfiles when loading a dir w/ crt

Ignore the files starting with a dot when trying to load a directory
with the "crt" directive.

Should fix issue #1689.

diff --git a/doc/configuration.txt b/doc/configuration.txt
index f4aba096d9d0d88ba247504ba6631d31090b3211..cab37b3d31dfbd63d3cda3a9fa92ef12d82fe4b1 100644 (file)
--- a/doc/configuration.txt
+++ b/doc/configuration.txt
@@ -13833,13 +13833,14 @@ crt <cert>
 
   If a directory name is used instead of a PEM file, then all files found in
   that directory will be loaded in alphabetic order unless their name ends
-  with '.key', '.issuer', '.ocsp' or '.sctl' (reserved extensions). This
-  directive may be specified multiple times in order to load certificates from
-  multiple files or directories. The certificates will be presented to clients
-  who provide a valid TLS Server Name Indication field matching one of their
-  CN or alt subjects. Wildcards are supported, where a wildcard character '*'
-  is used instead of the first hostname component (e.g. *.example.org matches
-  www.example.org but not www.sub.example.org).
+  with '.key', '.issuer', '.ocsp' or '.sctl' (reserved extensions). Files
+  starting with a dot are also ignored. This directive may be specified multiple
+  times in order to load certificates from multiple files or directories. The
+  certificates will be presented to clients who provide a valid TLS Server Name
+  Indication field matching one of their CN or alt subjects. Wildcards are
+  supported, where a wildcard character '*' is used instead of the first
+  hostname component (e.g. *.example.org matches www.example.org but not
+  www.sub.example.org).
 
   If no SNI is provided by the client or if the SSL library does not support
   TLS extensions, or if the client provides an SNI hostname which does not

diff --git a/src/ssl_crtlist.c b/src/ssl_crtlist.c
index 37f2e6f0aee826a5737bd2f5ca9a097fe18ef8e8..1615ac51dbd72eb08f97f7d911c3014c70baf646 100644 (file)
--- a/src/ssl_crtlist.c
+++ b/src/ssl_crtlist.c
@@ -696,7 +696,9 @@ int crtlist_load_cert_dir(char *path, struct bind_conf *bind_conf, struct crtlis
                        struct dirent *de = de_list[i];
 
                        end = strrchr(de->d_name, '.');
-                       if (end && (strcmp(end, ".issuer") == 0 || strcmp(end, ".ocsp") == 0 || strcmp(end, ".sctl") == 0 || strcmp(end, ".key") == 0))
+                       if (end && (de->d_name[0] == '.' ||
+                                   strcmp(end, ".issuer") == 0 || strcmp(end, ".ocsp") == 0 ||
+                                   strcmp(end, ".sctl") == 0 || strcmp(end, ".key") == 0))
                                goto ignore_entry;
 
                        snprintf(fp, sizeof(fp), "%s/%s", path, de->d_name);