tree 82720ecfdfd02dbc8f9fd7109f0e0f94e55ec21d
parent 77016daabed85789f858606495c3d79000f7fa6e
author William Lallemand <wlallemand@haproxy.com> 1597667479 +0200
committer William Lallemand <wlallemand@haproxy.org> 1597669020 +0200

BUG/MEDIUM: ssl: crt-list negative filters don't work

The negative filters which are supposed to exclude a SNI from a
wildcard, never worked. Indeed the negative filters were skipped in the
code.

To fix the issue, this patch looks for negative filters that are on the
same line as a the wildcard that just matched.

This patch should fix issue #818. It must be backported in 2.2.  The
problem also exists in versions > 1.8 but the infrastructure required to
fix this was only introduced in 2.1.  In older versions we should
probably change the documentation to state that negative filters are
useless.