MINOR: ssl: Remove client_crt member of the server's ssl context

The client_crt member is not used anymore since the server's ssl context
initialization now behaves the same way as the bind lines one (using
ckch stores and instances).

diff --git a/include/haproxy/server-t.h b/include/haproxy/server-t.h
index a1f72fd00a7ca2db4fdc2b7fd3fcabaca09af485..b29c75c0b9fb493a525ef9f45fe2e5ce8253c5dd 100644 (file)
--- a/include/haproxy/server-t.h
+++ b/include/haproxy/server-t.h
@@ -322,7 +322,6 @@ struct server {
                char *verify_host;              /* hostname of certificate must match this host */
                char *ca_file;                  /* CAfile to use on verify */
                char *crl_file;                 /* CRLfile to use on verify */
-               char *client_crt;               /* client certificate to send */
                struct sample_expr *sni;        /* sample expression for SNI */
 #ifdef OPENSSL_NPN_NEGOTIATED
                char *npn_str;                  /* NPN protocol string */

diff --git a/src/cfgparse-ssl.c b/src/cfgparse-ssl.c
index 55fe08463700c0c861d7b8789a3e5923957e629b..faacc0ee04946a2e98aa64ba4aa15572111f8b46 100644 (file)
--- a/src/cfgparse-ssl.c
+++ b/src/cfgparse-ssl.c
@@ -1442,17 +1442,25 @@ static int srv_parse_crl_file(char **args, int *cur_arg, struct proxy *px, struc
 /* parse the "crt" server keyword */
 static int srv_parse_crt(char **args, int *cur_arg, struct proxy *px, struct server *newsrv, char **err)
 {
+       int retval = -1;
+       char *path = NULL;
+
        if (!*args[*cur_arg + 1]) {
                memprintf(err, "'%s' : missing certificate file path", args[*cur_arg]);
                return ERR_ALERT | ERR_FATAL;
        }
 
        if ((*args[*cur_arg + 1] != '/') && global_ssl.crt_base)
-               memprintf(&newsrv->ssl_ctx.client_crt, "%s/%s", global_ssl.crt_base, args[*cur_arg + 1]);
+               memprintf(&path, "%s/%s", global_ssl.crt_base, args[*cur_arg + 1]);
        else
-               memprintf(&newsrv->ssl_ctx.client_crt, "%s", args[*cur_arg + 1]);
+               memprintf(&path, "%s", args[*cur_arg + 1]);
+
+       if (path) {
+               retval = ssl_sock_load_srv_cert(path, newsrv, err);
+               free(path);
+       }
 
-       return ssl_sock_load_srv_cert(newsrv->ssl_ctx.client_crt, newsrv, err);
+       return retval;
 }
 
 /* parse the "no-check-ssl" server keyword */

diff --git a/src/server.c b/src/server.c
index 956196528b650f3f476498001afaf5a663f3ae88..10f5286401c2e937f6d325bd2147d6d3ab9dfbc2 100644 (file)
--- a/src/server.c
+++ b/src/server.c
@@ -1535,8 +1535,6 @@ static void srv_ssl_settings_cpy(struct server *srv, struct server *src)
                srv->ssl_ctx.ca_file = strdup(src->ssl_ctx.ca_file);
        if (src->ssl_ctx.crl_file != NULL)
                srv->ssl_ctx.crl_file = strdup(src->ssl_ctx.crl_file);
-       if (src->ssl_ctx.client_crt != NULL)
-               srv->ssl_ctx.client_crt = strdup(src->ssl_ctx.client_crt);
 
        srv->ssl_ctx.verify = src->ssl_ctx.verify;