tree f1de34ed19bab242fff9d432b60f0ecc7879976d
parent bfadc02f34b348e654d0b14b7f6bab1e3363ce55
author Remi Tricot-Le Breton <rlebreton@haproxy.com> 1614184543 +0100
committer William Lallemand <wlallemand@haproxy.org> 1621241424 +0200

MEDIUM: ssl: Add "set+commit ssl ca-file" CLI commands

This patch adds the "set ssl ca-file" and "commit ssl ca-file" commands,
following the same logic as the certificate update equivalents.
When trying to update a ca-file entry via a "set" command, we start by
looking for the entry in the cafile_tree and then building a new
cafile_entry out of the given payload. This new object is not added to
the cafile_tree until "commit" is called.
During a "commit" command, we insert the newly built cafile_entry in the
cafile_tree, while keeping the previous entry as well. We then iterate
over all the instances linked in the old cafile_entry and rebuild a new
ckch instance for every one of them. The newly inserted cafile_entry is
used for all those new instances and their respective SSL contexts.
When all the contexts are properly created, the old instances get
replaced by the new ones and the old cafile_entry is removed from the
tree.

This fixes a subpart of GitHub issue #1057.