BUG/MINOR: ssl: fix crt-list neg filter for openssl < 1.1.1
Certificate selection in client_hello_cb (openssl >= 1.1.1) correctly
handles crt-list neg filter. Certificate selection for openssl < 1.1.1
has not been touched for a while: crt-list neg filter is not the same
than his counterpart and is wrong. Fix it to mimic the same behavior
has is counterpart.
It should be backported as far as 1.6.
(cherry picked from commit c5fdf0f3dcf91435c943742eaf338167e761dede)
[wt: adjusted context: tree was not locked in 2.0]
Signed-off-by: Willy Tarreau <w@1wt.eu>
diff --git a/src/ssl_sock.c b/src/ssl_sock.c
index 4307bbb..c61d1b1 100644
--- a/src/ssl_sock.c
+++ b/src/ssl_sock.c
@@ -2487,11 +2487,10 @@
}
trash.area[i] = 0;
+ node = NULL;
/* lookup in full qualified names */
- node = ebst_lookup(&s->sni_ctx, trash.area);
-
- /* lookup a not neg filter */
- for (n = node; n; n = ebmb_next_dup(n)) {
+ for (n = ebst_lookup(&s->sni_ctx, trash.area); n; n = ebmb_next_dup(n)) {
+ /* lookup a not neg filter */
if (!container_of(n, struct sni_ctx, name)->neg) {
node = n;
break;
@@ -2499,9 +2498,15 @@
}
if (!node && wildp) {
/* lookup in wildcards names */
- node = ebst_lookup(&s->sni_w_ctx, wildp);
+ for (n = ebst_lookup(&s->sni_w_ctx, wildp); n; n = ebmb_next_dup(n)) {
+ /* lookup a not neg filter */
+ if (!container_of(n, struct sni_ctx, name)->neg) {
+ node = n;
+ break;
+ }
+ }
}
- if (!node || container_of(node, struct sni_ctx, name)->neg) {
+ if (!node) {
#if (!defined SSL_NO_GENERATE_CERTIFICATES)
if (s->generate_certs && ssl_sock_generate_certificate(servername, s, ssl)) {
/* switch ctx done in ssl_sock_generate_certificate */