1 /*
2 *
3 * Copyright (C) 2020 HAProxy Technologies, William Lallemand <wlallemand@haproxy.com>
4 *
5 * This program is free software; you can redistribute it and/or
6 * modify it under the terms of the GNU General Public License
7 * as published by the Free Software Foundation; either version
8 * 2 of the License, or (at your option) any later version.
9 *
10 */
11 #include <sys/stat.h>
12 #include <sys/types.h>
13
14 #include <dirent.h>
15 #include <errno.h>
16 #include <stdlib.h>
17 #include <string.h>
18 #include <syslog.h>
19
20 #include <import/ebpttree.h>
21 #include <import/ebsttree.h>
22
23 #include <haproxy/channel.h>
24 #include <haproxy/cli.h>
25 #include <haproxy/errors.h>
26 #include <haproxy/ssl_ckch.h>
27 #include <haproxy/ssl_crtlist.h>
28 #include <haproxy/ssl_sock.h>
29 #include <haproxy/stream_interface.h>
30 #include <haproxy/tools.h>
31
32
33 /* release ssl bind conf */
ssl_sock_free_ssl_conf(struct ssl_bind_conf * conf)34 void ssl_sock_free_ssl_conf(struct ssl_bind_conf *conf)
35 {
36 if (conf) {
37 #if defined(OPENSSL_NPN_NEGOTIATED) && !defined(OPENSSL_NO_NEXTPROTONEG)
38 free(conf->npn_str);
39 conf->npn_str = NULL;
40 #endif
41 #ifdef TLSEXT_TYPE_application_layer_protocol_negotiation
42 free(conf->alpn_str);
43 conf->alpn_str = NULL;
44 #endif
45 free(conf->ca_file);
46 conf->ca_file = NULL;
47 free(conf->ca_verify_file);
48 conf->ca_verify_file = NULL;
49 free(conf->crl_file);
50 conf->crl_file = NULL;
51 free(conf->ciphers);
52 conf->ciphers = NULL;
53 #if (HA_OPENSSL_VERSION_NUMBER >= 0x10101000L)
54 free(conf->ciphersuites);
55 conf->ciphersuites = NULL;
56 #endif
57 free(conf->curves);
58 conf->curves = NULL;
59 free(conf->ecdhe);
60 conf->ecdhe = NULL;
61 }
62 }
63
64
65 /* free sni filters */
crtlist_free_filters(char ** args)66 void crtlist_free_filters(char **args)
67 {
68 int i;
69
70 if (!args)
71 return;
72
73 for (i = 0; args[i]; i++)
74 free(args[i]);
75
76 free(args);
77 }
78
79 /* Alloc and duplicate a char ** array */
crtlist_dup_filters(char ** args,int fcount)80 char **crtlist_dup_filters(char **args, int fcount)
81 {
82 char **dst;
83 int i;
84
85 if (fcount == 0)
86 return NULL;
87
88 dst = calloc(fcount + 1, sizeof(*dst));
89 if (!dst)
90 return NULL;
91
92 for (i = 0; i < fcount; i++) {
93 dst[i] = strdup(args[i]);
94 if (!dst[i])
95 goto error;
96 }
97 return dst;
98
99 error:
100 crtlist_free_filters(dst);
101 return NULL;
102 }
103
104 /*
105 * Detach and free a crtlist_entry.
106 * Free the filters, the ssl_conf and call ckch_inst_free() for each ckch_inst
107 */
crtlist_entry_free(struct crtlist_entry * entry)108 void crtlist_entry_free(struct crtlist_entry *entry)
109 {
110 struct ckch_inst *inst, *inst_s;
111
112 if (entry == NULL)
113 return;
114
115 ebpt_delete(&entry->node);
116 LIST_DEL(&entry->by_crtlist);
117 LIST_DEL(&entry->by_ckch_store);
118 crtlist_free_filters(entry->filters);
119 ssl_sock_free_ssl_conf(entry->ssl_conf);
120 free(entry->ssl_conf);
121 list_for_each_entry_safe(inst, inst_s, &entry->ckch_inst, by_crtlist_entry) {
122 ckch_inst_free(inst);
123 }
124 free(entry);
125 }
126
127 /*
128 * Allocate and initialize a crtlist_entry
129 */
crtlist_entry_new()130 struct crtlist_entry *crtlist_entry_new()
131 {
132 struct crtlist_entry *entry;
133
134 entry = calloc(1, sizeof(*entry));
135 if (entry == NULL)
136 return NULL;
137
138 LIST_INIT(&entry->ckch_inst);
139
140 /* initialize the nodes so we can LIST_DEL in any cases */
141 LIST_INIT(&entry->by_crtlist);
142 LIST_INIT(&entry->by_ckch_store);
143
144 return entry;
145 }
146
147 /* Free a crtlist, from the crt_entry to the content of the ssl_conf */
crtlist_free(struct crtlist * crtlist)148 void crtlist_free(struct crtlist *crtlist)
149 {
150 struct crtlist_entry *entry, *s_entry;
151 struct bind_conf_list *bind_conf_node;
152
153 if (crtlist == NULL)
154 return;
155
156 bind_conf_node = crtlist->bind_conf;
157 while (bind_conf_node) {
158 struct bind_conf_list *next = bind_conf_node->next;
159 free(bind_conf_node);
160 bind_conf_node = next;
161 }
162
163 list_for_each_entry_safe(entry, s_entry, &crtlist->ord_entries, by_crtlist) {
164 crtlist_entry_free(entry);
165 }
166 ebmb_delete(&crtlist->node);
167 free(crtlist);
168 }
169
170 /* Alloc and initialize a struct crtlist
171 * <filename> is the key of the ebmb_node
172 * <unique> initialize the list of entries to be unique (1) or not (0)
173 */
crtlist_new(const char * filename,int unique)174 struct crtlist *crtlist_new(const char *filename, int unique)
175 {
176 struct crtlist *newlist;
177
178 newlist = calloc(1, sizeof(*newlist) + strlen(filename) + 1);
179 if (newlist == NULL)
180 return NULL;
181
182 memcpy(newlist->node.key, filename, strlen(filename) + 1);
183 if (unique)
184 newlist->entries = EB_ROOT_UNIQUE;
185 else
186 newlist->entries = EB_ROOT;
187
188 LIST_INIT(&newlist->ord_entries);
189
190 return newlist;
191 }
192
193 /*
194 * Read a single crt-list line. /!\ alter the <line> string.
195 * Fill <crt_path> and <crtlist_entry>
196 * <crtlist_entry> must be alloc and free by the caller
197 * <crtlist_entry->ssl_conf> is alloc by the function
198 * <crtlist_entry->filters> is alloc by the function
199 * <crt_path> is a ptr in <line>
200 * Return an error code
201 */
crtlist_parse_line(char * line,char ** crt_path,struct crtlist_entry * entry,const char * file,int linenum,int from_cli,char ** err)202 int crtlist_parse_line(char *line, char **crt_path, struct crtlist_entry *entry, const char *file, int linenum, int from_cli, char **err)
203 {
204 int cfgerr = 0;
205 int arg, newarg, cur_arg, i, ssl_b = 0, ssl_e = 0;
206 char *end;
207 char *args[MAX_CRT_ARGS + 1];
208 struct ssl_bind_conf *ssl_conf = NULL;
209
210 if (!line || !crt_path || !entry)
211 return ERR_ALERT | ERR_FATAL;
212
213 end = line + strlen(line);
214 if (end-line >= CRT_LINESIZE-1 && *(end-1) != '\n') {
215 /* Check if we reached the limit and the last char is not \n.
216 * Watch out for the last line without the terminating '\n'!
217 */
218 memprintf(err, "line %d too long in file '%s', limit is %d characters",
219 linenum, file, CRT_LINESIZE-1);
220 cfgerr |= ERR_ALERT | ERR_FATAL;
221 goto error;
222 }
223 arg = 0;
224 newarg = 1;
225 while (*line) {
226 if (isspace((unsigned char)*line)) {
227 newarg = 1;
228 *line = 0;
229 } else if (*line == '[') {
230 if (ssl_b) {
231 memprintf(err, "too many '[' on line %d in file '%s'.", linenum, file);
232 cfgerr |= ERR_ALERT | ERR_FATAL;
233 goto error;
234 }
235 if (!arg) {
236 memprintf(err, "file must start with a cert on line %d in file '%s'", linenum, file);
237 cfgerr |= ERR_ALERT | ERR_FATAL;
238 goto error;
239 }
240 ssl_b = arg;
241 newarg = 1;
242 *line = 0;
243 } else if (*line == ']') {
244 if (ssl_e) {
245 memprintf(err, "too many ']' on line %d in file '%s'.", linenum, file);
246 cfgerr |= ERR_ALERT | ERR_FATAL;
247 goto error;
248 }
249 if (!ssl_b) {
250 memprintf(err, "missing '[' in line %d in file '%s'.", linenum, file);
251 cfgerr |= ERR_ALERT | ERR_FATAL;
252 goto error;
253 }
254 ssl_e = arg;
255 newarg = 1;
256 *line = 0;
257 } else if (newarg) {
258 if (arg == MAX_CRT_ARGS) {
259 memprintf(err, "too many args on line %d in file '%s'.", linenum, file);
260 cfgerr |= ERR_ALERT | ERR_FATAL;
261 goto error;
262 }
263 newarg = 0;
264 args[arg++] = line;
265 }
266 line++;
267 }
268 args[arg++] = line;
269
270 /* empty line */
271 if (!*args[0]) {
272 cfgerr |= ERR_NONE;
273 goto error;
274 }
275
276 *crt_path = args[0];
277
278 if (ssl_b) {
279 ssl_conf = calloc(1, sizeof *ssl_conf);
280 if (!ssl_conf) {
281 memprintf(err, "not enough memory!");
282 cfgerr |= ERR_ALERT | ERR_FATAL;
283 goto error;
284 }
285 }
286
287 cur_arg = ssl_b ? ssl_b : 1;
288 while (cur_arg < ssl_e) {
289 newarg = 0;
290 for (i = 0; ssl_bind_kws[i].kw != NULL; i++) {
291 if (strcmp(ssl_bind_kws[i].kw, args[cur_arg]) == 0) {
292 newarg = 1;
293 cfgerr |= ssl_bind_kws[i].parse(args, cur_arg, NULL, ssl_conf, from_cli, err);
294 if (cur_arg + 1 + ssl_bind_kws[i].skip > ssl_e) {
295 memprintf(err, "ssl args out of '[]' for %s on line %d in file '%s'",
296 args[cur_arg], linenum, file);
297 cfgerr |= ERR_ALERT | ERR_FATAL;
298 goto error;
299 }
300 cur_arg += 1 + ssl_bind_kws[i].skip;
301 break;
302 }
303 }
304 if (!cfgerr && !newarg) {
305 memprintf(err, "unknown ssl keyword %s on line %d in file '%s'.",
306 args[cur_arg], linenum, file);
307 cfgerr |= ERR_ALERT | ERR_FATAL;
308 goto error;
309 }
310 }
311 entry->linenum = linenum;
312 entry->ssl_conf = ssl_conf;
313 entry->filters = crtlist_dup_filters(&args[cur_arg], arg - cur_arg - 1);
314 entry->fcount = arg - cur_arg - 1;
315
316 return cfgerr;
317
318 error:
319 crtlist_free_filters(entry->filters);
320 entry->filters = NULL;
321 ssl_sock_free_ssl_conf(entry->ssl_conf);
322 free(entry->ssl_conf);
323 entry->ssl_conf = NULL;
324 return cfgerr;
325 }
326
327
328
329 /* This function parse a crt-list file and store it in a struct crtlist, each line is a crtlist_entry structure
330 * Fill the <crtlist> argument with a pointer to a new crtlist struct
331 *
332 * This function tries to open and store certificate files.
333 */
crtlist_parse_file(char * file,struct bind_conf * bind_conf,struct proxy * curproxy,struct crtlist ** crtlist,char ** err)334 int crtlist_parse_file(char *file, struct bind_conf *bind_conf, struct proxy *curproxy, struct crtlist **crtlist, char **err)
335 {
336 struct crtlist *newlist;
337 struct crtlist_entry *entry = NULL;
338 char thisline[CRT_LINESIZE];
339 char path[MAXPATHLEN+1];
340 FILE *f;
341 struct stat buf;
342 int linenum = 0;
343 int cfgerr = 0;
344 int missing_lf = -1;
345
346 if ((f = fopen(file, "r")) == NULL) {
347 memprintf(err, "cannot open file '%s' : %s", file, strerror(errno));
348 return ERR_ALERT | ERR_FATAL;
349 }
350
351 newlist = crtlist_new(file, 0);
352 if (newlist == NULL) {
353 memprintf(err, "Not enough memory!");
354 cfgerr |= ERR_ALERT | ERR_FATAL;
355 goto error;
356 }
357
358 while (fgets(thisline, sizeof(thisline), f) != NULL) {
359 char *end;
360 char *line = thisline;
361 char *crt_path;
362 struct ckch_store *ckchs;
363
364 if (missing_lf != -1) {
365 memprintf(err, "parsing [%s:%d]: Stray NUL character at position %d.\n",
366 file, linenum, (missing_lf + 1));
367 cfgerr |= ERR_WARN;
368 missing_lf = -1;
369 break;
370 }
371
372 linenum++;
373 end = line + strlen(line);
374 if (end-line == sizeof(thisline)-1 && *(end-1) != '\n') {
375 /* Check if we reached the limit and the last char is not \n.
376 * Watch out for the last line without the terminating '\n'!
377 */
378 memprintf(err, "line %d too long in file '%s', limit is %d characters",
379 linenum, file, (int)sizeof(thisline)-1);
380 cfgerr |= ERR_ALERT | ERR_FATAL;
381 break;
382 }
383
384 if (*line == '#' || *line == '\n' || *line == '\r')
385 continue;
386
387 if (end > line && *(end-1) == '\n') {
388 /* kill trailing LF */
389 *(end - 1) = 0;
390 }
391 else {
392 /* mark this line as truncated */
393 missing_lf = end - line;
394 }
395
396 entry = crtlist_entry_new();
397 if (entry == NULL) {
398 memprintf(err, "Not enough memory!");
399 cfgerr |= ERR_ALERT | ERR_FATAL;
400 goto error;
401 }
402
403 cfgerr |= crtlist_parse_line(thisline, &crt_path, entry, file, linenum, 0, err);
404 if (cfgerr & ERR_CODE)
405 goto error;
406
407 /* empty line */
408 if (!crt_path || !*crt_path) {
409 crtlist_entry_free(entry);
410 entry = NULL;
411 continue;
412 }
413
414 if (*crt_path != '/' && global_ssl.crt_base) {
415 if ((strlen(global_ssl.crt_base) + 1 + strlen(crt_path)) > MAXPATHLEN) {
416 memprintf(err, "'%s' : path too long on line %d in file '%s'",
417 crt_path, linenum, file);
418 cfgerr |= ERR_ALERT | ERR_FATAL;
419 goto error;
420 }
421 snprintf(path, sizeof(path), "%s/%s", global_ssl.crt_base, crt_path);
422 crt_path = path;
423 }
424
425 /* Look for a ckch_store or create one */
426 ckchs = ckchs_lookup(crt_path);
427 if (ckchs == NULL) {
428 if (stat(crt_path, &buf) == 0)
429 ckchs = ckchs_load_cert_file(crt_path, 0, err);
430 else
431 ckchs = ckchs_load_cert_file(crt_path, 1, err);
432 }
433 if (ckchs == NULL) {
434 cfgerr |= ERR_ALERT | ERR_FATAL;
435 goto error;
436 }
437
438 if (cfgerr & ERR_CODE)
439 goto error;
440
441 entry->node.key = ckchs;
442 entry->crtlist = newlist;
443 ebpt_insert(&newlist->entries, &entry->node);
444 LIST_ADDQ(&newlist->ord_entries, &entry->by_crtlist);
445 LIST_ADDQ(&ckchs->crtlist_entry, &entry->by_ckch_store);
446
447 entry = NULL;
448 }
449
450 if (missing_lf != -1) {
451 memprintf(err, "parsing [%s:%d]: Missing LF on last line, file might have been truncated at position %d.\n",
452 file, linenum, (missing_lf + 1));
453 cfgerr |= ERR_WARN;
454 }
455
456 if (cfgerr & ERR_CODE)
457 goto error;
458
459 newlist->linecount = linenum;
460
461 fclose(f);
462 *crtlist = newlist;
463
464 return cfgerr;
465 error:
466 crtlist_entry_free(entry);
467
468 fclose(f);
469 crtlist_free(newlist);
470 return cfgerr;
471 }
472
473 /* This function reads a directory and stores it in a struct crtlist, each file is a crtlist_entry structure
474 * Fill the <crtlist> argument with a pointer to a new crtlist struct
475 *
476 * This function tries to open and store certificate files.
477 */
crtlist_load_cert_dir(char * path,struct bind_conf * bind_conf,struct crtlist ** crtlist,char ** err)478 int crtlist_load_cert_dir(char *path, struct bind_conf *bind_conf, struct crtlist **crtlist, char **err)
479 {
480 struct crtlist *dir;
481 struct dirent **de_list;
482 int i, n;
483 struct stat buf;
484 char *end;
485 char fp[MAXPATHLEN+1];
486 int cfgerr = 0;
487 struct ckch_store *ckchs;
488 #if HA_OPENSSL_VERSION_NUMBER >= 0x1000200fL
489 int is_bundle;
490 int j;
491 #endif
492
493 dir = crtlist_new(path, 1);
494 if (dir == NULL) {
495 memprintf(err, "not enough memory");
496 return ERR_ALERT | ERR_FATAL;
497 }
498
499 n = scandir(path, &de_list, 0, alphasort);
500 if (n < 0) {
501 memprintf(err, "%sunable to scan directory '%s' : %s.\n",
502 err && *err ? *err : "", path, strerror(errno));
503 cfgerr |= ERR_ALERT | ERR_FATAL;
504 }
505 else {
506 for (i = 0; i < n; i++) {
507 struct crtlist_entry *entry;
508 struct dirent *de = de_list[i];
509
510 end = strrchr(de->d_name, '.');
511 if (end && (!strcmp(end, ".issuer") || !strcmp(end, ".ocsp") || !strcmp(end, ".sctl") || !strcmp(end, ".key")))
512 goto ignore_entry;
513
514 snprintf(fp, sizeof(fp), "%s/%s", path, de->d_name);
515 if (stat(fp, &buf) != 0) {
516 memprintf(err, "%sunable to stat SSL certificate from file '%s' : %s.\n",
517 err && *err ? *err : "", fp, strerror(errno));
518 cfgerr |= ERR_ALERT | ERR_FATAL;
519 goto ignore_entry;
520 }
521 if (!S_ISREG(buf.st_mode))
522 goto ignore_entry;
523
524 entry = crtlist_entry_new();
525 if (entry == NULL) {
526 memprintf(err, "not enough memory '%s'", fp);
527 cfgerr |= ERR_ALERT | ERR_FATAL;
528 goto ignore_entry;
529 }
530
531 #if HA_OPENSSL_VERSION_NUMBER >= 0x1000200fL
532 is_bundle = 0;
533 /* Check if current entry in directory is part of a multi-cert bundle */
534
535 if ((global_ssl.extra_files & SSL_GF_BUNDLE) && end) {
536 for (j = 0; j < SSL_SOCK_NUM_KEYTYPES; j++) {
537 if (!strcmp(end + 1, SSL_SOCK_KEYTYPE_NAMES[j])) {
538 is_bundle = 1;
539 break;
540 }
541 }
542
543 if (is_bundle) {
544 int dp_len;
545
546 dp_len = end - de->d_name;
547
548 /* increment i and free de until we get to a non-bundle cert
549 * Note here that we look at de_list[i + 1] before freeing de
550 * this is important since ignore_entry will free de. This also
551 * guarantees that de->d_name continues to hold the same prefix.
552 */
553 while (i + 1 < n && !strncmp(de_list[i + 1]->d_name, de->d_name, dp_len)) {
554 free(de);
555 i++;
556 de = de_list[i];
557 }
558
559 snprintf(fp, sizeof(fp), "%s/%.*s", path, dp_len, de->d_name);
560 ckchs = ckchs_lookup(fp);
561 if (ckchs == NULL)
562 ckchs = ckchs_load_cert_file(fp, 1, err);
563 if (ckchs == NULL) {
564 free(de);
565 free(entry);
566 cfgerr |= ERR_ALERT | ERR_FATAL;
567 goto end;
568 }
569 entry->node.key = ckchs;
570 entry->crtlist = dir;
571 LIST_ADDQ(&ckchs->crtlist_entry, &entry->by_ckch_store);
572 LIST_ADDQ(&dir->ord_entries, &entry->by_crtlist);
573 ebpt_insert(&dir->entries, &entry->node);
574
575 /* Successfully processed the bundle */
576 goto ignore_entry;
577 }
578 }
579
580 #endif
581 ckchs = ckchs_lookup(fp);
582 if (ckchs == NULL)
583 ckchs = ckchs_load_cert_file(fp, 0, err);
584 if (ckchs == NULL) {
585 free(de);
586 free(entry);
587 cfgerr |= ERR_ALERT | ERR_FATAL;
588 goto end;
589 }
590 entry->node.key = ckchs;
591 entry->crtlist = dir;
592 LIST_ADDQ(&ckchs->crtlist_entry, &entry->by_ckch_store);
593 LIST_ADDQ(&dir->ord_entries, &entry->by_crtlist);
594 ebpt_insert(&dir->entries, &entry->node);
595
596 ignore_entry:
597 free(de);
598 }
599 end:
600 free(de_list);
601 }
602
603 if (cfgerr & ERR_CODE) {
604 /* free the dir and entries on error */
605 crtlist_free(dir);
606 } else {
607 *crtlist = dir;
608 }
609 return cfgerr;
610
611 }
612
613 /*
614 * Take an ssl_bind_conf structure and append the configuration line used to
615 * create it in the buffer
616 */
dump_crtlist_sslconf(struct buffer * buf,const struct ssl_bind_conf * conf)617 static void dump_crtlist_sslconf(struct buffer *buf, const struct ssl_bind_conf *conf)
618 {
619 int space = 0;
620
621 if (conf == NULL)
622 return;
623
624 chunk_appendf(buf, " [");
625 #ifdef OPENSSL_NPN_NEGOTIATED
626 if (conf->npn_str) {
627 int len = conf->npn_len;
628 char *ptr = conf->npn_str;
629 int comma = 0;
630
631 if (space) chunk_appendf(buf, " ");
632 chunk_appendf(buf, "npn ");
633 while (len) {
634 unsigned short size;
635
636 size = *ptr;
637 ptr++;
638 if (comma)
639 chunk_memcat(buf, ",", 1);
640 chunk_memcat(buf, ptr, size);
641 ptr += size;
642 len -= size + 1;
643 comma = 1;
644 }
645 chunk_memcat(buf, "", 1); /* finish with a \0 */
646 space++;
647 }
648 #endif
649 #ifdef TLSEXT_TYPE_application_layer_protocol_negotiation
650 if (conf->alpn_str) {
651 int len = conf->alpn_len;
652 char *ptr = conf->alpn_str;
653 int comma = 0;
654
655 if (space) chunk_appendf(buf, " ");
656 chunk_appendf(buf, "alpn ");
657 while (len) {
658 unsigned short size;
659
660 size = *ptr;
661 ptr++;
662 if (comma)
663 chunk_memcat(buf, ",", 1);
664 chunk_memcat(buf, ptr, size);
665 ptr += size;
666 len -= size + 1;
667 comma = 1;
668 }
669 chunk_memcat(buf, "", 1); /* finish with a \0 */
670 space++;
671 }
672 #endif
673 /* verify */
674 {
675 if (conf->verify == SSL_SOCK_VERIFY_NONE) {
676 if (space) chunk_appendf(buf, " ");
677 chunk_appendf(buf, "verify none");
678 space++;
679 } else if (conf->verify == SSL_SOCK_VERIFY_OPTIONAL) {
680 if (space) chunk_appendf(buf, " ");
681 chunk_appendf(buf, "verify optional");
682 space++;
683 } else if (conf->verify == SSL_SOCK_VERIFY_REQUIRED) {
684 if (space) chunk_appendf(buf, " ");
685 chunk_appendf(buf, "verify required");
686 space++;
687 }
688 }
689
690 if (conf->no_ca_names) {
691 if (space) chunk_appendf(buf, " ");
692 chunk_appendf(buf, "no-ca-names");
693 space++;
694 }
695
696 if (conf->early_data) {
697 if (space) chunk_appendf(buf, " ");
698 chunk_appendf(buf, "allow-0rtt");
699 space++;
700 }
701 if (conf->ca_file) {
702 if (space) chunk_appendf(buf, " ");
703 chunk_appendf(buf, "ca-file %s", conf->ca_file);
704 space++;
705 }
706 if (conf->crl_file) {
707 if (space) chunk_appendf(buf, " ");
708 chunk_appendf(buf, "crl-file %s", conf->crl_file);
709 space++;
710 }
711 if (conf->ciphers) {
712 if (space) chunk_appendf(buf, " ");
713 chunk_appendf(buf, "ciphers %s", conf->ciphers);
714 space++;
715 }
716 #if (HA_OPENSSL_VERSION_NUMBER >= 0x10101000L && !defined OPENSSL_IS_BORINGSSL && !defined LIBRESSL_VERSION_NUMBER)
717 if (conf->ciphersuites) {
718 if (space) chunk_appendf(buf, " ");
719 chunk_appendf(buf, "ciphersuites %s", conf->ciphersuites);
720 space++;
721 }
722 #endif
723 if (conf->curves) {
724 if (space) chunk_appendf(buf, " ");
725 chunk_appendf(buf, "curves %s", conf->curves);
726 space++;
727 }
728 if (conf->ecdhe) {
729 if (space) chunk_appendf(buf, " ");
730 chunk_appendf(buf, "ecdhe %s", conf->ecdhe);
731 space++;
732 }
733
734 /* the crt-lists only support ssl-min-ver and ssl-max-ver */
735 if (conf->ssl_methods_cfg.min) {
736 if (space) chunk_appendf(buf, " ");
737 chunk_appendf(buf, "ssl-min-ver %s", methodVersions[conf->ssl_methods_cfg.min].name);
738 space++;
739 }
740
741 if (conf->ssl_methods_cfg.max) {
742 if (space) chunk_appendf(buf, " ");
743 chunk_appendf(buf, "ssl-max-ver %s", methodVersions[conf->ssl_methods_cfg.max].name);
744 space++;
745 }
746
747 chunk_appendf(buf, "]");
748
749 return;
750 }
751
752 /* dump a list of filters */
dump_crtlist_filters(struct buffer * buf,struct crtlist_entry * entry)753 static void dump_crtlist_filters(struct buffer *buf, struct crtlist_entry *entry)
754 {
755 int i;
756
757 if (!entry->fcount)
758 return;
759
760 for (i = 0; i < entry->fcount; i++) {
761 chunk_appendf(buf, " %s", entry->filters[i]);
762 }
763 return;
764 }
765
766 /************************** CLI functions ****************************/
767
768
769 /* CLI IO handler for '(show|dump) ssl crt-list' */
cli_io_handler_dump_crtlist(struct appctx * appctx)770 static int cli_io_handler_dump_crtlist(struct appctx *appctx)
771 {
772 struct buffer *trash = alloc_trash_chunk();
773 struct stream_interface *si = appctx->owner;
774 struct ebmb_node *lnode;
775
776 if (trash == NULL)
777 return 1;
778
779 /* dump the list of crt-lists */
780 lnode = appctx->ctx.cli.p1;
781 if (lnode == NULL)
782 lnode = ebmb_first(&crtlists_tree);
783 while (lnode) {
784 chunk_appendf(trash, "%s\n", lnode->key);
785 if (ci_putchk(si_ic(si), trash) == -1) {
786 si_rx_room_blk(si);
787 goto yield;
788 }
789 lnode = ebmb_next(lnode);
790 }
791 free_trash_chunk(trash);
792 return 1;
793 yield:
794 appctx->ctx.cli.p1 = lnode;
795 free_trash_chunk(trash);
796 return 0;
797 }
798
799 /* CLI IO handler for '(show|dump) ssl crt-list <filename>' */
cli_io_handler_dump_crtlist_entries(struct appctx * appctx)800 static int cli_io_handler_dump_crtlist_entries(struct appctx *appctx)
801 {
802 struct buffer *trash = alloc_trash_chunk();
803 struct crtlist *crtlist;
804 struct stream_interface *si = appctx->owner;
805 struct crtlist_entry *entry;
806
807 if (trash == NULL)
808 return 1;
809
810 crtlist = ebmb_entry(appctx->ctx.cli.p0, struct crtlist, node);
811
812 entry = appctx->ctx.cli.p1;
813 if (entry == NULL) {
814 entry = LIST_ELEM((crtlist->ord_entries).n, typeof(entry), by_crtlist);
815 chunk_appendf(trash, "# %s\n", crtlist->node.key);
816 if (ci_putchk(si_ic(si), trash) == -1) {
817 si_rx_room_blk(si);
818 goto yield;
819 }
820 }
821
822 list_for_each_entry_from(entry, &crtlist->ord_entries, by_crtlist) {
823 struct ckch_store *store;
824 const char *filename;
825
826 store = entry->node.key;
827 filename = store->path;
828 chunk_appendf(trash, "%s", filename);
829 if (appctx->ctx.cli.i0 == 's') /* show */
830 chunk_appendf(trash, ":%d", entry->linenum);
831 dump_crtlist_sslconf(trash, entry->ssl_conf);
832 dump_crtlist_filters(trash, entry);
833 chunk_appendf(trash, "\n");
834
835 if (ci_putchk(si_ic(si), trash) == -1) {
836 si_rx_room_blk(si);
837 goto yield;
838 }
839 }
840 free_trash_chunk(trash);
841 return 1;
842 yield:
843 appctx->ctx.cli.p1 = entry;
844 free_trash_chunk(trash);
845 return 0;
846 }
847
848 /* CLI argument parser for '(show|dump) ssl crt-list' */
cli_parse_dump_crtlist(char ** args,char * payload,struct appctx * appctx,void * private)849 static int cli_parse_dump_crtlist(char **args, char *payload, struct appctx *appctx, void *private)
850 {
851 struct ebmb_node *lnode;
852 char *filename = NULL;
853 int mode;
854 char *end;
855
856 if (!cli_has_level(appctx, ACCESS_LVL_ADMIN))
857 return 1;
858
859 appctx->ctx.cli.p0 = NULL;
860 appctx->ctx.cli.p1 = NULL;
861
862 if (*args[3] && !strcmp(args[3], "-n")) {
863 mode = 's';
864 filename = args[4];
865 } else {
866 mode = 'd';
867 filename = args[3];
868 }
869
870 if (mode == 's' && !*args[4])
871 return cli_err(appctx, "'show ssl crt-list -n' expects a filename or a directory\n");
872
873 if (filename && *filename) {
874
875
876 /* strip trailing slashes, including first one */
877 for (end = filename + strlen(filename) - 1; end >= filename && *end == '/'; end--)
878 *end = 0;
879
880 lnode = ebst_lookup(&crtlists_tree, filename);
881 if (lnode == NULL)
882 return cli_err(appctx, "didn't find the specified filename\n");
883
884 appctx->ctx.cli.p0 = lnode;
885 appctx->io_handler = cli_io_handler_dump_crtlist_entries;
886 }
887 appctx->ctx.cli.i0 = mode;
888
889 return 0;
890 }
891
892 /* release function of the "add ssl crt-list' command, free things and unlock
893 the spinlock */
cli_release_add_crtlist(struct appctx * appctx)894 static void cli_release_add_crtlist(struct appctx *appctx)
895 {
896 struct crtlist_entry *entry = appctx->ctx.cli.p1;
897
898 if (appctx->st2 != SETCERT_ST_FIN) {
899 struct ckch_inst *inst, *inst_s;
900 /* upon error free the ckch_inst and everything inside */
901 ebpt_delete(&entry->node);
902 LIST_DEL(&entry->by_crtlist);
903 LIST_DEL(&entry->by_ckch_store);
904
905 list_for_each_entry_safe(inst, inst_s, &entry->ckch_inst, by_ckchs) {
906 ckch_inst_free(inst);
907 }
908 crtlist_free_filters(entry->filters);
909 ssl_sock_free_ssl_conf(entry->ssl_conf);
910 free(entry->ssl_conf);
911 free(entry);
912 }
913
914 HA_SPIN_UNLOCK(CKCH_LOCK, &ckch_lock);
915 }
916
917
918 /* IO Handler for the "add ssl crt-list" command It adds a new entry in the
919 * crt-list and generates the ckch_insts for each bind_conf that uses this crt-list
920 *
921 * The logic is the same as the "commit ssl cert" command but without the
922 * freeing of the old structures, because there are none.
923 */
cli_io_handler_add_crtlist(struct appctx * appctx)924 static int cli_io_handler_add_crtlist(struct appctx *appctx)
925 {
926 struct bind_conf_list *bind_conf_node;
927 struct stream_interface *si = appctx->owner;
928 struct crtlist *crtlist = appctx->ctx.cli.p0;
929 struct crtlist_entry *entry = appctx->ctx.cli.p1;
930 struct ckch_store *store = entry->node.key;
931 struct buffer *trash = alloc_trash_chunk();
932 struct ckch_inst *new_inst;
933 char *err = NULL;
934 int i = 0;
935 int errcode = 0;
936
937 if (trash == NULL)
938 goto error;
939
940 /* for each bind_conf which use the crt-list, a new ckch_inst must be
941 * created.
942 */
943 if (unlikely(si_ic(si)->flags & (CF_WRITE_ERROR|CF_SHUTW)))
944 goto error;
945
946 while (1) {
947 switch (appctx->st2) {
948 case SETCERT_ST_INIT:
949 /* This state just print the update message */
950 chunk_printf(trash, "Inserting certificate '%s' in crt-list '%s'", store->path, crtlist->node.key);
951 if (ci_putchk(si_ic(si), trash) == -1) {
952 si_rx_room_blk(si);
953 goto yield;
954 }
955 appctx->st2 = SETCERT_ST_GEN;
956 /* fallthrough */
957 case SETCERT_ST_GEN:
958 bind_conf_node = appctx->ctx.cli.p2; /* get the previous ptr from the yield */
959 if (bind_conf_node == NULL)
960 bind_conf_node = crtlist->bind_conf;
961 for (; bind_conf_node; bind_conf_node = bind_conf_node->next) {
962 struct bind_conf *bind_conf = bind_conf_node->bind_conf;
963 struct sni_ctx *sni;
964
965 /* yield every 10 generations */
966 if (i > 10) {
967 appctx->ctx.cli.p2 = bind_conf_node;
968 goto yield;
969 }
970
971 /* we don't support multi-cert bundles, only simple ones */
972 errcode |= ckch_inst_new_load_store(store->path, store, bind_conf, entry->ssl_conf, entry->filters, entry->fcount, &new_inst, &err);
973 if (errcode & ERR_CODE)
974 goto error;
975
976 /* we need to initialize the SSL_CTX generated */
977 /* this iterate on the newly generated SNIs in the new instance to prepare their SSL_CTX */
978 list_for_each_entry(sni, &new_inst->sni_ctx, by_ckch_inst) {
979 if (!sni->order) { /* we initialized only the first SSL_CTX because it's the same in the other sni_ctx's */
980 errcode |= ssl_sock_prepare_ctx(bind_conf, new_inst->ssl_conf, sni->ctx, &err);
981 if (errcode & ERR_CODE)
982 goto error;
983 }
984 }
985 /* display one dot for each new instance */
986 chunk_appendf(trash, ".");
987 i++;
988 LIST_ADDQ(&store->ckch_inst, &new_inst->by_ckchs);
989 LIST_ADDQ(&entry->ckch_inst, &new_inst->by_crtlist_entry);
990 new_inst->crtlist_entry = entry;
991 }
992 appctx->st2 = SETCERT_ST_INSERT;
993 /* fallthrough */
994 case SETCERT_ST_INSERT:
995 /* insert SNIs in bind_conf */
996 list_for_each_entry(new_inst, &store->ckch_inst, by_ckchs) {
997 HA_RWLOCK_WRLOCK(SNI_LOCK, &new_inst->bind_conf->sni_lock);
998 ssl_sock_load_cert_sni(new_inst, new_inst->bind_conf);
999 HA_RWLOCK_WRUNLOCK(SNI_LOCK, &new_inst->bind_conf->sni_lock);
1000 }
1001 entry->linenum = ++crtlist->linecount;
1002 appctx->st2 = SETCERT_ST_FIN;
1003 goto end;
1004 }
1005 }
1006
1007 end:
1008 chunk_appendf(trash, "\n");
1009 if (errcode & ERR_WARN)
1010 chunk_appendf(trash, "%s", err);
1011 chunk_appendf(trash, "Success!\n");
1012 if (ci_putchk(si_ic(si), trash) == -1)
1013 si_rx_room_blk(si);
1014 free_trash_chunk(trash);
1015 /* success: call the release function and don't come back */
1016 return 1;
1017 yield:
1018 /* store the state */
1019 if (ci_putchk(si_ic(si), trash) == -1)
1020 si_rx_room_blk(si);
1021 free_trash_chunk(trash);
1022 si_rx_endp_more(si); /* let's come back later */
1023 return 0; /* should come back */
1024
1025 error:
1026 /* spin unlock and free are done in the release function */
1027 if (trash) {
1028 chunk_appendf(trash, "\n%sFailed!\n", err);
1029 if (ci_putchk(si_ic(si), trash) == -1)
1030 si_rx_room_blk(si);
1031 free_trash_chunk(trash);
1032 }
1033 /* error: call the release function and don't come back */
1034 return 1;
1035 }
1036
1037
1038 /*
1039 * Parse a "add ssl crt-list <crt-list> <certfile>" line.
1040 * Filters and option must be passed through payload:
1041 */
cli_parse_add_crtlist(char ** args,char * payload,struct appctx * appctx,void * private)1042 static int cli_parse_add_crtlist(char **args, char *payload, struct appctx *appctx, void *private)
1043 {
1044 int cfgerr = 0;
1045 struct ckch_store *store;
1046 char *err = NULL;
1047 char path[MAXPATHLEN+1];
1048 char *crtlist_path;
1049 char *cert_path = NULL;
1050 struct ebmb_node *eb;
1051 struct ebpt_node *inserted;
1052 struct crtlist *crtlist;
1053 struct crtlist_entry *entry = NULL;
1054 char *end;
1055
1056 if (!cli_has_level(appctx, ACCESS_LVL_ADMIN))
1057 return 1;
1058
1059 if (!*args[3] || (!payload && !*args[4]))
1060 return cli_err(appctx, "'add ssl crtlist' expects a filename and a certificate name\n");
1061
1062 crtlist_path = args[3];
1063
1064 /* strip trailing slashes, including first one */
1065 for (end = crtlist_path + strlen(crtlist_path) - 1; end >= crtlist_path && *end == '/'; end--)
1066 *end = 0;
1067
1068 if (HA_SPIN_TRYLOCK(CKCH_LOCK, &ckch_lock))
1069 return cli_err(appctx, "Operations on certificates are currently locked!\n");
1070
1071 eb = ebst_lookup(&crtlists_tree, crtlist_path);
1072 if (!eb) {
1073 memprintf(&err, "crt-list '%s' does not exist!", crtlist_path);
1074 goto error;
1075 }
1076 crtlist = ebmb_entry(eb, struct crtlist, node);
1077
1078 entry = crtlist_entry_new();
1079 if (entry == NULL) {
1080 memprintf(&err, "Not enough memory!");
1081 goto error;
1082 }
1083
1084 if (payload) {
1085 char *lf;
1086
1087 lf = strrchr(payload, '\n');
1088 if (lf) {
1089 memprintf(&err, "only one line of payload is supported!");
1090 goto error;
1091 }
1092 /* cert_path is filled here */
1093 cfgerr |= crtlist_parse_line(payload, &cert_path, entry, "CLI", 1, 1, &err);
1094 if (cfgerr & ERR_CODE)
1095 goto error;
1096 } else {
1097 cert_path = args[4];
1098 }
1099
1100 if (!cert_path) {
1101 memprintf(&err, "'add ssl crtlist' should contain the certificate name in the payload");
1102 cfgerr |= ERR_ALERT | ERR_FATAL;
1103 goto error;
1104 }
1105
1106 if (eb_gettag(crtlist->entries.b[EB_RGHT])) {
1107 char *slash;
1108
1109 slash = strrchr(cert_path, '/');
1110 if (!slash) {
1111 memprintf(&err, "'%s' is a directory, certificate path '%s' must contain the directory path", (char *)crtlist->node.key, cert_path);
1112 goto error;
1113 }
1114 /* temporary replace / by 0 to do an strcmp */
1115 *slash = '\0';
1116 if (strcmp(cert_path, (char*)crtlist->node.key) != 0) {
1117 *slash = '/';
1118 memprintf(&err, "'%s' is a directory, certificate path '%s' must contain the directory path", (char *)crtlist->node.key, cert_path);
1119 goto error;
1120 }
1121 *slash = '/';
1122 }
1123
1124 if (*cert_path != '/' && global_ssl.crt_base) {
1125 if ((strlen(global_ssl.crt_base) + 1 + strlen(cert_path)) > MAXPATHLEN) {
1126 memprintf(&err, "'%s' : path too long", cert_path);
1127 cfgerr |= ERR_ALERT | ERR_FATAL;
1128 goto error;
1129 }
1130 snprintf(path, sizeof(path), "%s/%s", global_ssl.crt_base, cert_path);
1131 cert_path = path;
1132 }
1133
1134 store = ckchs_lookup(cert_path);
1135 if (store == NULL) {
1136 memprintf(&err, "certificate '%s' does not exist!", cert_path);
1137 goto error;
1138 }
1139 if (store->multi) {
1140 memprintf(&err, "certificate '%s' is a bundle. You can disable the bundle merging with the directive 'ssl-load-extra-files' in the global section.", cert_path);
1141 goto error;
1142 }
1143 if (store->ckch == NULL || store->ckch->cert == NULL) {
1144 memprintf(&err, "certificate '%s' is empty!", cert_path);
1145 goto error;
1146 }
1147
1148 /* check if it's possible to insert this new crtlist_entry */
1149 entry->node.key = store;
1150 inserted = ebpt_insert(&crtlist->entries, &entry->node);
1151 if (inserted != &entry->node) {
1152 memprintf(&err, "file already exists in this directory!");
1153 goto error;
1154 }
1155
1156 /* this is supposed to be a directory (EB_ROOT_UNIQUE), so no ssl_conf are allowed */
1157 if ((entry->ssl_conf || entry->filters) && eb_gettag(crtlist->entries.b[EB_RGHT])) {
1158 memprintf(&err, "this is a directory, SSL configuration and filters are not allowed");
1159 goto error;
1160 }
1161
1162 LIST_ADDQ(&crtlist->ord_entries, &entry->by_crtlist);
1163 entry->crtlist = crtlist;
1164 LIST_ADDQ(&store->crtlist_entry, &entry->by_ckch_store);
1165
1166 appctx->st2 = SETCERT_ST_INIT;
1167 appctx->ctx.cli.p0 = crtlist;
1168 appctx->ctx.cli.p1 = entry;
1169
1170 /* unlock is done in the release handler */
1171 return 0;
1172
1173 error:
1174 crtlist_entry_free(entry);
1175 HA_SPIN_UNLOCK(CKCH_LOCK, &ckch_lock);
1176 err = memprintf(&err, "Can't edit the crt-list: %s\n", err ? err : "");
1177 return cli_dynerr(appctx, err);
1178 }
1179
1180 /* Parse a "del ssl crt-list <crt-list> <certfile>" line. */
cli_parse_del_crtlist(char ** args,char * payload,struct appctx * appctx,void * private)1181 static int cli_parse_del_crtlist(char **args, char *payload, struct appctx *appctx, void *private)
1182 {
1183 struct ckch_store *store;
1184 char *err = NULL;
1185 char *crtlist_path, *cert_path;
1186 struct ebmb_node *ebmb;
1187 struct ebpt_node *ebpt;
1188 struct crtlist *crtlist;
1189 struct crtlist_entry *entry = NULL;
1190 struct ckch_inst *inst, *inst_s;
1191 int linenum = 0;
1192 char *colons;
1193 char *end;
1194 int error_message_dumped = 0;
1195
1196 if (!cli_has_level(appctx, ACCESS_LVL_ADMIN))
1197 return 1;
1198
1199 if (!*args[3] || !*args[4])
1200 return cli_err(appctx, "'del ssl crtlist' expects a filename and a certificate name\n");
1201
1202 if (HA_SPIN_TRYLOCK(CKCH_LOCK, &ckch_lock))
1203 return cli_err(appctx, "Can't delete!\nOperations on certificates are currently locked!\n");
1204
1205 crtlist_path = args[3];
1206 cert_path = args[4];
1207
1208 colons = strchr(cert_path, ':');
1209 if (colons) {
1210 char *endptr;
1211
1212 linenum = strtol(colons + 1, &endptr, 10);
1213 if (colons + 1 == endptr || *endptr != '\0') {
1214 memprintf(&err, "wrong line number after colons in '%s'!", cert_path);
1215 goto error;
1216 }
1217 *colons = '\0';
1218 }
1219
1220 /* strip trailing slashes, including first one */
1221 for (end = crtlist_path + strlen(crtlist_path) - 1; end >= crtlist_path && *end == '/'; end--)
1222 *end = 0;
1223
1224 /* look for crtlist */
1225 ebmb = ebst_lookup(&crtlists_tree, crtlist_path);
1226 if (!ebmb) {
1227 memprintf(&err, "crt-list '%s' does not exist!", crtlist_path);
1228 goto error;
1229 }
1230 crtlist = ebmb_entry(ebmb, struct crtlist, node);
1231
1232 /* look for store */
1233 store = ckchs_lookup(cert_path);
1234 if (store == NULL) {
1235 memprintf(&err, "certificate '%s' does not exist!", cert_path);
1236 goto error;
1237 }
1238 if (store->multi) {
1239 memprintf(&err, "certificate '%s' is a bundle. You can disable the bundle merging with the directive 'ssl-load-extra-files' in the global section.", cert_path);
1240 goto error;
1241 }
1242 if (store->ckch == NULL || store->ckch->cert == NULL) {
1243 memprintf(&err, "certificate '%s' is empty!", cert_path);
1244 goto error;
1245 }
1246
1247 ebpt = ebpt_lookup(&crtlist->entries, store);
1248 if (!ebpt) {
1249 memprintf(&err, "certificate '%s' can't be found in crt-list '%s'!", cert_path, crtlist_path);
1250 goto error;
1251 }
1252
1253 /* list the line number of entries for errors in err, and select the right ebpt */
1254 for (; ebpt; ebpt = ebpt_next_dup(ebpt)) {
1255 struct crtlist_entry *tmp;
1256
1257 tmp = ebpt_entry(ebpt, struct crtlist_entry, node);
1258 memprintf(&err, "%s%s%d", err ? err : "", err ? ", " : "", tmp->linenum);
1259
1260 /* select the entry we wanted */
1261 if (linenum == 0 || tmp->linenum == linenum) {
1262 if (!entry)
1263 entry = tmp;
1264 }
1265 }
1266
1267 /* we didn't found the specified entry */
1268 if (!entry) {
1269 memprintf(&err, "found a certificate '%s' but the line number is incorrect, please specify a correct line number preceded by colons (%s)!", cert_path, err ? err : NULL);
1270 goto error;
1271 }
1272
1273 /* we didn't specified a line number but there were several entries */
1274 if (linenum == 0 && ebpt_next_dup(&entry->node)) {
1275 memprintf(&err, "found the certificate '%s' in several entries, please specify a line number preceded by colons (%s)!", cert_path, err ? err : NULL);
1276 goto error;
1277 }
1278
1279 /* Iterate over all the instances in order to see if any of them is a
1280 * default instance. If this is the case, the entry won't be suppressed. */
1281 list_for_each_entry_safe(inst, inst_s, &entry->ckch_inst, by_crtlist_entry) {
1282 if (inst->is_default && !inst->bind_conf->strict_sni) {
1283 if (!error_message_dumped) {
1284 memprintf(&err, "certificate '%s' cannot be deleted, it is used as default certificate by the following frontends:\n", cert_path);
1285 error_message_dumped = 1;
1286 }
1287 memprintf(&err, "%s\t- %s:%d\n", err, inst->bind_conf->file, inst->bind_conf->line);
1288 }
1289 }
1290 if (error_message_dumped)
1291 goto error;
1292
1293 /* upon error free the ckch_inst and everything inside */
1294
1295 ebpt_delete(&entry->node);
1296 LIST_DEL(&entry->by_crtlist);
1297 LIST_DEL(&entry->by_ckch_store);
1298
1299 list_for_each_entry_safe(inst, inst_s, &entry->ckch_inst, by_crtlist_entry) {
1300 struct sni_ctx *sni, *sni_s;
1301
1302 HA_RWLOCK_WRLOCK(SNI_LOCK, &inst->bind_conf->sni_lock);
1303 list_for_each_entry_safe(sni, sni_s, &inst->sni_ctx, by_ckch_inst) {
1304 ebmb_delete(&sni->name);
1305 LIST_DEL(&sni->by_ckch_inst);
1306 SSL_CTX_free(sni->ctx);
1307 free(sni);
1308 }
1309 HA_RWLOCK_WRUNLOCK(SNI_LOCK, &inst->bind_conf->sni_lock);
1310 LIST_DEL(&inst->by_ckchs);
1311 free(inst);
1312 }
1313
1314 crtlist_free_filters(entry->filters);
1315 ssl_sock_free_ssl_conf(entry->ssl_conf);
1316 free(entry->ssl_conf);
1317 free(entry);
1318
1319 HA_SPIN_UNLOCK(CKCH_LOCK, &ckch_lock);
1320 err = memprintf(&err, "Entry '%s' deleted in crtlist '%s'!\n", cert_path, crtlist_path);
1321 return cli_dynmsg(appctx, LOG_NOTICE, err);
1322
1323 error:
1324 HA_SPIN_UNLOCK(CKCH_LOCK, &ckch_lock);
1325 err = memprintf(&err, "Can't delete the entry: %s\n", err ? err : "");
1326 return cli_dynerr(appctx, err);
1327 }
1328
1329
1330 /* unlink and free all crt-list and crt-list entries */
crtlist_deinit()1331 void crtlist_deinit()
1332 {
1333 struct eb_node *node, *next;
1334 struct crtlist *crtlist;
1335
1336 node = eb_first(&crtlists_tree);
1337 while (node) {
1338 next = eb_next(node);
1339 crtlist = ebmb_entry(node, struct crtlist, node);
1340 crtlist_free(crtlist);
1341 node = next;
1342 }
1343 }
1344
1345
1346 /* register cli keywords */
1347 static struct cli_kw_list cli_kws = {{ },{
1348 { { "add", "ssl", "crt-list", NULL }, "add ssl crt-list <filename> <certfile> [options] : add a line <certfile> to a crt-list <filename>", cli_parse_add_crtlist, cli_io_handler_add_crtlist, cli_release_add_crtlist },
1349 { { "del", "ssl", "crt-list", NULL }, "del ssl crt-list <filename> <certfile[:line]> : delete a line <certfile> in a crt-list <filename>", cli_parse_del_crtlist, NULL, NULL },
1350 { { "show", "ssl", "crt-list", NULL }, "show ssl crt-list [-n] [<filename>] : show the list of crt-lists or the content of a crt-list <filename>", cli_parse_dump_crtlist, cli_io_handler_dump_crtlist, NULL },
1351 { { NULL }, NULL, NULL, NULL } }
1352 };
1353
1354 INITCALL1(STG_REGISTER, cli_register_kw, &cli_kws);
1355
1356