BUG/MINOR: ssl/cli: 'set ssl cert' does not check the transaction name correctly

Since commit  089c13850f ("MEDIUM: ssl: ssl-load-extra-del-ext work
only with .crt"), the 'set ssl cert' CLI command does not check
correctly if the transaction you are trying to update is the right one.

The consequence is that you could commit accidentaly a transaction on
the wrong certificate.

The fix introduces the check again in case you are not using
ssl-load-extra-del-ext.

This must be backported in all stable versions.

diff --git a/src/ssl_ckch.c b/src/ssl_ckch.c
index a2ba4b83e7f02d566b7cbec04333a6f8676ce0da..92ed13e65d95cc01139b29bc6274f2c109fa7c85 100644 (file)
--- a/src/ssl_ckch.c
+++ b/src/ssl_ckch.c
@@ -2600,7 +2600,7 @@ static int cli_parse_set_cert(char **args, char *payload, struct appctx *appctx,
                                        errcode |= ERR_ALERT | ERR_FATAL;
                                        goto end;
                                }
-
+                               /* check again with the right extension */
                                if (strcmp(ckchs_transaction.path, buf->area) != 0) {
                                        /* remove .crt of the error message */
                                        *(b_orig(buf) + b_data(buf) + strlen(".crt")) = '\0';
@@ -2610,6 +2610,11 @@ static int cli_parse_set_cert(char **args, char *payload, struct appctx *appctx,
                                        errcode |= ERR_ALERT | ERR_FATAL;
                                        goto end;
                                }
+                       } else {
+                               /* without del-ext the error is definitive */
+                               memprintf(&err, "The ongoing transaction is about '%s' but you are trying to set '%s'\n", ckchs_transaction.path, buf->area);
+                               errcode |= ERR_ALERT | ERR_FATAL;
+                               goto end;
                        }
                }