tree e49db0037a1c9c2e93b20b71c3137235c0eb58f6
parent 5daff3c8abc658760a0d0c5fbbc633bfff1afe44
author Remi Tricot-Le Breton <rlebreton@haproxy.com> 1614014774 +0100
committer William Lallemand <wlallemand@haproxy.org> 1621241424 +0200

MEDIUM: ssl: Add a way to load a ca-file content from memory

The updated CA content coming from the CLI during a ca-file update will
directly be in memory and not on disk so the way CAs are loaded in a
cafile_entry for now (via X509_STORE_load_locations calls) cannot be
used.
This patch adds a way to fill a cafile_entry directly from memory and to
load the contained certificate and CRL sections into an SSL store.
CRL sections are managed as well as certificates in order to mimic the
way CA files are processed when specified in an option. Indeed, when
parsing a CA file given through a ca-file or ca-verify-file option, we
iterate over the different sections in ssl_set_cert_crl_file and load
them regardless of their type. This ensures that a file that was
properly parsed when given as an option will also be accepted by the
CLI.