tree 5acb3ed61038e238d705f59eb6dda42025df6e64
parent 0a52846603507411b6e6391448876dfc26c02499
author William Lallemand <wlallemand@haproxy.com> 1583769399 +0100
committer William Lallemand <wlallemand@haproxy.org> 1583771524 +0100

BUG/MINOR: ssl/cli: sni_ctx' mustn't always be used as filters

Since commit 244b070 ("MINOR: ssl/cli: support crt-list filters"),
HAProxy generates a list of filters based on the sni_ctx in memory.
However it's not always relevant, sometimes no filters were configured
and the CN/SAN in the new certificate are not the same.

This patch fixes the issue by using a flag filters in the ckch_inst, so
we are able to know if there were filters or not. In the late case it
uses the CN/SAN of the new certificate to generate the sni_ctx.

note: filters are still only used in the crt-list atm.