blob: f7007efc6c7596e8b40edb0aaf3458fba5b1cfd6 [file] [log] [blame]
William Lallemand6e9556b2020-05-12 17:52:44 +02001/*
2 *
3 * Copyright (C) 2020 HAProxy Technologies, William Lallemand <wlallemand@haproxy.com>
4 *
5 * This program is free software; you can redistribute it and/or
6 * modify it under the terms of the GNU General Public License
7 * as published by the Free Software Foundation; either version
8 * 2 of the License, or (at your option) any later version.
9 *
10 */
Willy Tarreaub2551052020-06-09 09:07:15 +020011#include <sys/stat.h>
12#include <sys/types.h>
William Lallemand6e9556b2020-05-12 17:52:44 +020013
Willy Tarreaub2551052020-06-09 09:07:15 +020014#include <dirent.h>
William Lallemand212e9932020-05-18 08:33:09 +020015#include <errno.h>
William Lallemand6e9556b2020-05-12 17:52:44 +020016#include <stdlib.h>
17#include <string.h>
Willy Tarreauaeed4a82020-06-04 22:01:04 +020018#include <syslog.h>
Willy Tarreaub2551052020-06-09 09:07:15 +020019
20#include <import/ebpttree.h>
21#include <import/ebsttree.h>
William Lallemand6e9556b2020-05-12 17:52:44 +020022
Willy Tarreauf1d32c42020-06-04 21:07:02 +020023#include <haproxy/channel.h>
Willy Tarreau83487a82020-06-04 20:19:54 +020024#include <haproxy/cli.h>
Willy Tarreau8d366972020-05-27 16:10:29 +020025#include <haproxy/errors.h>
Willy Tarreau47d7f902020-06-04 14:25:47 +020026#include <haproxy/ssl_ckch.h>
Willy Tarreau52d88722020-06-04 14:29:23 +020027#include <haproxy/ssl_crtlist.h>
Willy Tarreau209108d2020-06-04 20:30:20 +020028#include <haproxy/ssl_sock.h>
Willy Tarreau5e539c92020-06-04 20:45:39 +020029#include <haproxy/stream_interface.h>
Willy Tarreau48fbcae2020-06-03 18:09:46 +020030#include <haproxy/tools.h>
William Lallemand6e9556b2020-05-12 17:52:44 +020031
William Lallemand6e9556b2020-05-12 17:52:44 +020032
William Lallemand6e9556b2020-05-12 17:52:44 +020033/* release ssl bind conf */
34void ssl_sock_free_ssl_conf(struct ssl_bind_conf *conf)
35{
36 if (conf) {
37#if defined(OPENSSL_NPN_NEGOTIATED) && !defined(OPENSSL_NO_NEXTPROTONEG)
38 free(conf->npn_str);
39 conf->npn_str = NULL;
40#endif
41#ifdef TLSEXT_TYPE_application_layer_protocol_negotiation
42 free(conf->alpn_str);
43 conf->alpn_str = NULL;
44#endif
45 free(conf->ca_file);
46 conf->ca_file = NULL;
47 free(conf->ca_verify_file);
48 conf->ca_verify_file = NULL;
49 free(conf->crl_file);
50 conf->crl_file = NULL;
51 free(conf->ciphers);
52 conf->ciphers = NULL;
53#if (HA_OPENSSL_VERSION_NUMBER >= 0x10101000L)
54 free(conf->ciphersuites);
55 conf->ciphersuites = NULL;
56#endif
57 free(conf->curves);
58 conf->curves = NULL;
59 free(conf->ecdhe);
60 conf->ecdhe = NULL;
61 }
62}
63
William Lallemand82f2d2f2020-09-10 19:06:43 +020064/*
65 * Allocate and copy a ssl_bind_conf structure
66 */
67struct ssl_bind_conf *crtlist_dup_ssl_conf(struct ssl_bind_conf *src)
68{
69 struct ssl_bind_conf *dst;
70
71 if (!src)
72 return NULL;
73
74 dst = calloc(1, sizeof(*dst));
75 if (!dst)
76 return NULL;
77
78#if defined(OPENSSL_NPN_NEGOTIATED) && !defined(OPENSSL_NO_NEXTPROTONEG)
79 if (src->npn_str) {
80 dst->npn_str = strdup(src->npn_str);
81 if (!dst->npn_str)
82 goto error;
83 }
84#endif
85#ifdef TLSEXT_TYPE_application_layer_protocol_negotiation
86 if (src->alpn_str) {
87 dst->alpn_str = strdup(src->alpn_str);
88 if (!dst->alpn_str)
89 goto error;
90 }
91#endif
92 if (src->ca_file) {
93 dst->ca_file = strdup(src->ca_file);
94 if (!dst->ca_file)
95 goto error;
96 }
97 if (src->ca_verify_file) {
98 dst->ca_verify_file = strdup(src->ca_verify_file);
99 if (!dst->ca_verify_file)
100 goto error;
101 }
102 if (src->crl_file) {
103 dst->crl_file = strdup(src->crl_file);
104 if (!dst->crl_file)
105 goto error;
106 }
107 if (src->ciphers) {
108 dst->ciphers = strdup(src->ciphers);
109 if (!dst->ciphers)
110 goto error;
111 }
112#if (HA_OPENSSL_VERSION_NUMBER >= 0x10101000L)
113 if (src->ciphersuites) {
114 dst->ciphersuites = strdup(src->ciphersuites);
115 if (!dst->ciphersuites)
116 goto error;
117 }
118#endif
119 if (src->curves) {
120 dst->curves = strdup(src->curves);
121 if (!dst->curves)
122 goto error;
123 }
124 if (src->ecdhe) {
125 dst->ecdhe = strdup(src->ecdhe);
126 if (!dst->ecdhe)
127 goto error;
128 }
129 return dst;
130
131error:
132 ssl_sock_free_ssl_conf(dst);
133 free(dst);
134
135 return NULL;
136}
William Lallemand6e9556b2020-05-12 17:52:44 +0200137
138/* free sni filters */
139void crtlist_free_filters(char **args)
140{
141 int i;
142
143 if (!args)
144 return;
145
146 for (i = 0; args[i]; i++)
147 free(args[i]);
148
149 free(args);
150}
151
152/* Alloc and duplicate a char ** array */
153char **crtlist_dup_filters(char **args, int fcount)
154{
155 char **dst;
156 int i;
157
158 if (fcount == 0)
159 return NULL;
160
161 dst = calloc(fcount + 1, sizeof(*dst));
162 if (!dst)
163 return NULL;
164
165 for (i = 0; i < fcount; i++) {
166 dst[i] = strdup(args[i]);
167 if (!dst[i])
168 goto error;
169 }
170 return dst;
171
172error:
173 crtlist_free_filters(dst);
174 return NULL;
175}
176
177/*
178 * Detach and free a crtlist_entry.
179 * Free the filters, the ssl_conf and call ckch_inst_free() for each ckch_inst
180 */
181void crtlist_entry_free(struct crtlist_entry *entry)
182{
183 struct ckch_inst *inst, *inst_s;
184
185 if (entry == NULL)
186 return;
187
188 ebpt_delete(&entry->node);
189 LIST_DEL(&entry->by_crtlist);
190 LIST_DEL(&entry->by_ckch_store);
191 crtlist_free_filters(entry->filters);
192 ssl_sock_free_ssl_conf(entry->ssl_conf);
193 free(entry->ssl_conf);
194 list_for_each_entry_safe(inst, inst_s, &entry->ckch_inst, by_crtlist_entry) {
195 ckch_inst_free(inst);
196 }
197 free(entry);
198}
William Lallemand5622c452020-09-10 19:08:49 +0200199/*
200 * Duplicate a crt_list entry and its content (ssl_conf, filters/fcount)
201 * Return a pointer to the new entry
202 */
203struct crtlist_entry *crtlist_entry_dup(struct crtlist_entry *src)
204{
205 struct crtlist_entry *entry;
206
207 if (src == NULL)
208 return NULL;
209
210 entry = crtlist_entry_new();
211 if (entry == NULL)
212 return NULL;
213
214 if (src->filters) {
215 entry->filters = crtlist_dup_filters(src->filters, src->fcount);
216 if (!entry->filters)
217 goto error;
218 }
219 entry->fcount = src->fcount;
220 if (src->ssl_conf) {
221 entry->ssl_conf = crtlist_dup_ssl_conf(src->ssl_conf);
222 if (!entry->ssl_conf)
223 goto error;
224 }
225 entry->crtlist = src->crtlist;
226
227 return entry;
228
229error:
230
231 crtlist_free_filters(entry->filters);
232 ssl_sock_free_ssl_conf(entry->ssl_conf);
233 free(entry->ssl_conf);
234 free(entry);
235
236 return NULL;
237}
William Lallemand6e9556b2020-05-12 17:52:44 +0200238
239/*
240 * Allocate and initialize a crtlist_entry
241 */
242struct crtlist_entry *crtlist_entry_new()
243{
244 struct crtlist_entry *entry;
245
246 entry = calloc(1, sizeof(*entry));
247 if (entry == NULL)
248 return NULL;
249
250 LIST_INIT(&entry->ckch_inst);
251
252 /* initialize the nodes so we can LIST_DEL in any cases */
253 LIST_INIT(&entry->by_crtlist);
254 LIST_INIT(&entry->by_ckch_store);
255
256 return entry;
257}
258
259/* Free a crtlist, from the crt_entry to the content of the ssl_conf */
260void crtlist_free(struct crtlist *crtlist)
261{
262 struct crtlist_entry *entry, *s_entry;
William Lallemand6a3168a2020-06-23 11:43:35 +0200263 struct bind_conf_list *bind_conf_node;
William Lallemand6e9556b2020-05-12 17:52:44 +0200264
265 if (crtlist == NULL)
266 return;
267
William Lallemand6a3168a2020-06-23 11:43:35 +0200268 bind_conf_node = crtlist->bind_conf;
269 while (bind_conf_node) {
270 struct bind_conf_list *next = bind_conf_node->next;
271 free(bind_conf_node);
272 bind_conf_node = next;
273 }
274
William Lallemand6e9556b2020-05-12 17:52:44 +0200275 list_for_each_entry_safe(entry, s_entry, &crtlist->ord_entries, by_crtlist) {
276 crtlist_entry_free(entry);
277 }
278 ebmb_delete(&crtlist->node);
279 free(crtlist);
280}
281
282/* Alloc and initialize a struct crtlist
283 * <filename> is the key of the ebmb_node
284 * <unique> initialize the list of entries to be unique (1) or not (0)
285 */
286struct crtlist *crtlist_new(const char *filename, int unique)
287{
288 struct crtlist *newlist;
289
290 newlist = calloc(1, sizeof(*newlist) + strlen(filename) + 1);
291 if (newlist == NULL)
292 return NULL;
293
294 memcpy(newlist->node.key, filename, strlen(filename) + 1);
295 if (unique)
296 newlist->entries = EB_ROOT_UNIQUE;
297 else
298 newlist->entries = EB_ROOT;
299
300 LIST_INIT(&newlist->ord_entries);
301
302 return newlist;
303}
304
305/*
306 * Read a single crt-list line. /!\ alter the <line> string.
307 * Fill <crt_path> and <crtlist_entry>
308 * <crtlist_entry> must be alloc and free by the caller
309 * <crtlist_entry->ssl_conf> is alloc by the function
310 * <crtlist_entry->filters> is alloc by the function
311 * <crt_path> is a ptr in <line>
312 * Return an error code
313 */
314int crtlist_parse_line(char *line, char **crt_path, struct crtlist_entry *entry, const char *file, int linenum, char **err)
315{
316 int cfgerr = 0;
317 int arg, newarg, cur_arg, i, ssl_b = 0, ssl_e = 0;
318 char *end;
319 char *args[MAX_CRT_ARGS + 1];
320 struct ssl_bind_conf *ssl_conf = NULL;
321
322 if (!line || !crt_path || !entry)
323 return ERR_ALERT | ERR_FATAL;
324
325 end = line + strlen(line);
326 if (end-line >= CRT_LINESIZE-1 && *(end-1) != '\n') {
327 /* Check if we reached the limit and the last char is not \n.
328 * Watch out for the last line without the terminating '\n'!
329 */
330 memprintf(err, "line %d too long in file '%s', limit is %d characters",
331 linenum, file, CRT_LINESIZE-1);
332 cfgerr |= ERR_ALERT | ERR_FATAL;
333 goto error;
334 }
335 arg = 0;
336 newarg = 1;
337 while (*line) {
338 if (isspace((unsigned char)*line)) {
339 newarg = 1;
340 *line = 0;
341 } else if (*line == '[') {
342 if (ssl_b) {
343 memprintf(err, "too many '[' on line %d in file '%s'.", linenum, file);
344 cfgerr |= ERR_ALERT | ERR_FATAL;
345 goto error;
346 }
347 if (!arg) {
348 memprintf(err, "file must start with a cert on line %d in file '%s'", linenum, file);
349 cfgerr |= ERR_ALERT | ERR_FATAL;
350 goto error;
351 }
352 ssl_b = arg;
353 newarg = 1;
354 *line = 0;
355 } else if (*line == ']') {
356 if (ssl_e) {
357 memprintf(err, "too many ']' on line %d in file '%s'.", linenum, file);
358 cfgerr |= ERR_ALERT | ERR_FATAL;
359 goto error;
360 }
361 if (!ssl_b) {
362 memprintf(err, "missing '[' in line %d in file '%s'.", linenum, file);
363 cfgerr |= ERR_ALERT | ERR_FATAL;
364 goto error;
365 }
366 ssl_e = arg;
367 newarg = 1;
368 *line = 0;
369 } else if (newarg) {
370 if (arg == MAX_CRT_ARGS) {
371 memprintf(err, "too many args on line %d in file '%s'.", linenum, file);
372 cfgerr |= ERR_ALERT | ERR_FATAL;
373 goto error;
374 }
375 newarg = 0;
376 args[arg++] = line;
377 }
378 line++;
379 }
380 args[arg++] = line;
381
382 /* empty line */
383 if (!*args[0]) {
384 cfgerr |= ERR_NONE;
385 goto error;
386 }
387
388 *crt_path = args[0];
389
390 if (ssl_b) {
391 ssl_conf = calloc(1, sizeof *ssl_conf);
392 if (!ssl_conf) {
393 memprintf(err, "not enough memory!");
394 cfgerr |= ERR_ALERT | ERR_FATAL;
395 goto error;
396 }
397 }
398 cur_arg = ssl_b ? ssl_b : 1;
399 while (cur_arg < ssl_e) {
400 newarg = 0;
401 for (i = 0; ssl_bind_kws[i].kw != NULL; i++) {
402 if (strcmp(ssl_bind_kws[i].kw, args[cur_arg]) == 0) {
403 newarg = 1;
404 cfgerr |= ssl_bind_kws[i].parse(args, cur_arg, NULL, ssl_conf, err);
405 if (cur_arg + 1 + ssl_bind_kws[i].skip > ssl_e) {
406 memprintf(err, "ssl args out of '[]' for %s on line %d in file '%s'",
407 args[cur_arg], linenum, file);
408 cfgerr |= ERR_ALERT | ERR_FATAL;
409 goto error;
410 }
411 cur_arg += 1 + ssl_bind_kws[i].skip;
412 break;
413 }
414 }
415 if (!cfgerr && !newarg) {
416 memprintf(err, "unknown ssl keyword %s on line %d in file '%s'.",
417 args[cur_arg], linenum, file);
418 cfgerr |= ERR_ALERT | ERR_FATAL;
419 goto error;
420 }
421 }
422 entry->linenum = linenum;
423 entry->ssl_conf = ssl_conf;
424 entry->filters = crtlist_dup_filters(&args[cur_arg], arg - cur_arg - 1);
425 entry->fcount = arg - cur_arg - 1;
426
427 return cfgerr;
428
429error:
430 crtlist_free_filters(entry->filters);
431 entry->filters = NULL;
432 ssl_sock_free_ssl_conf(entry->ssl_conf);
433 free(entry->ssl_conf);
434 entry->ssl_conf = NULL;
435 return cfgerr;
436}
437
438
439
440/* This function parse a crt-list file and store it in a struct crtlist, each line is a crtlist_entry structure
441 * Fill the <crtlist> argument with a pointer to a new crtlist struct
442 *
443 * This function tries to open and store certificate files.
444 */
445int crtlist_parse_file(char *file, struct bind_conf *bind_conf, struct proxy *curproxy, struct crtlist **crtlist, char **err)
446{
447 struct crtlist *newlist;
448 struct crtlist_entry *entry = NULL;
449 char thisline[CRT_LINESIZE];
450 char path[MAXPATHLEN+1];
451 FILE *f;
452 struct stat buf;
453 int linenum = 0;
454 int cfgerr = 0;
455
456 if ((f = fopen(file, "r")) == NULL) {
457 memprintf(err, "cannot open file '%s' : %s", file, strerror(errno));
458 return ERR_ALERT | ERR_FATAL;
459 }
460
461 newlist = crtlist_new(file, 0);
462 if (newlist == NULL) {
463 memprintf(err, "Not enough memory!");
464 cfgerr |= ERR_ALERT | ERR_FATAL;
465 goto error;
466 }
467
468 while (fgets(thisline, sizeof(thisline), f) != NULL) {
469 char *end;
470 char *line = thisline;
471 char *crt_path;
472 struct ckch_store *ckchs;
473
474 linenum++;
475 end = line + strlen(line);
476 if (end-line == sizeof(thisline)-1 && *(end-1) != '\n') {
477 /* Check if we reached the limit and the last char is not \n.
478 * Watch out for the last line without the terminating '\n'!
479 */
480 memprintf(err, "line %d too long in file '%s', limit is %d characters",
481 linenum, file, (int)sizeof(thisline)-1);
482 cfgerr |= ERR_ALERT | ERR_FATAL;
483 break;
484 }
485
486 if (*line == '#' || *line == '\n' || *line == '\r')
487 continue;
488
489 entry = crtlist_entry_new();
490 if (entry == NULL) {
491 memprintf(err, "Not enough memory!");
492 cfgerr |= ERR_ALERT | ERR_FATAL;
493 goto error;
494 }
William Lallemand0354b652020-09-16 11:55:09 +0200495 if (*(end - 1) == '\n')
496 *(end - 1) = '\0'; /* line parser mustn't receive any \n */
William Lallemand6e9556b2020-05-12 17:52:44 +0200497 cfgerr |= crtlist_parse_line(thisline, &crt_path, entry, file, linenum, err);
498 if (cfgerr)
499 goto error;
500
501 /* empty line */
502 if (!crt_path || !*crt_path) {
503 crtlist_entry_free(entry);
504 entry = NULL;
505 continue;
506 }
507
508 if (*crt_path != '/' && global_ssl.crt_base) {
509 if ((strlen(global_ssl.crt_base) + 1 + strlen(crt_path)) > MAXPATHLEN) {
510 memprintf(err, "'%s' : path too long on line %d in file '%s'",
511 crt_path, linenum, file);
512 cfgerr |= ERR_ALERT | ERR_FATAL;
513 goto error;
514 }
515 snprintf(path, sizeof(path), "%s/%s", global_ssl.crt_base, crt_path);
516 crt_path = path;
517 }
518
519 /* Look for a ckch_store or create one */
520 ckchs = ckchs_lookup(crt_path);
521 if (ckchs == NULL) {
William Lallemand47da8212020-09-10 19:13:27 +0200522 if (stat(crt_path, &buf) == 0) {
523
William Lallemandbd8e6ed2020-09-16 16:08:08 +0200524 ckchs = ckchs_load_cert_file(crt_path, err);
William Lallemand47da8212020-09-10 19:13:27 +0200525 if (ckchs == NULL) {
526 cfgerr |= ERR_ALERT | ERR_FATAL;
527 goto error;
528 }
529
530 entry->node.key = ckchs;
531 entry->crtlist = newlist;
532 ebpt_insert(&newlist->entries, &entry->node);
533 LIST_ADDQ(&newlist->ord_entries, &entry->by_crtlist);
534 LIST_ADDQ(&ckchs->crtlist_entry, &entry->by_ckch_store);
William Lallemand6e9556b2020-05-12 17:52:44 +0200535
William Lallemand47da8212020-09-10 19:13:27 +0200536 } else {
537 /* If we didn't find the file, this could be a
538 bundle, since 2.3 we don't support OpenSSL
539 multi-certificate bundle, so we emulate it by
540 loading each file separately. To do so we need
541 to duplicate the entry in the crt-list because
542 it becomes independent */
543 char fp[MAXPATHLEN+1] = {0};
544 int n = 0;
545 struct crtlist_entry *entry_dup = entry; /* use the previous created entry */
546 for (n = 0; n < SSL_SOCK_NUM_KEYTYPES; n++) {
547 struct stat buf;
548 int ret;
549
550 ret = snprintf(fp, sizeof(fp), "%s.%s", path, SSL_SOCK_KEYTYPE_NAMES[n]);
551 if (ret > sizeof(fp))
552 continue;
553
554 ckchs = ckchs_lookup(fp);
555 if (!ckchs && stat(fp, &buf) == 0) {
556
William Lallemandbd8e6ed2020-09-16 16:08:08 +0200557 ckchs = ckchs_load_cert_file(fp, err);
William Lallemand47da8212020-09-10 19:13:27 +0200558 if (ckchs == NULL) {
559 cfgerr |= ERR_ALERT | ERR_FATAL;
560 goto error;
561 }
562
563 linenum++; /* we duplicate the line for this entry in the bundle */
564 if (!entry_dup) { /* if the entry was used, duplicate one */
565 linenum++;
566 entry_dup = crtlist_entry_dup(entry);
567 if (!entry_dup) {
568 cfgerr |= ERR_ALERT | ERR_FATAL;
569 goto error;
570 }
571 entry_dup->linenum = linenum;
572 }
573
574 entry_dup->node.key = ckchs;
575 entry_dup->crtlist = newlist;
576 ebpt_insert(&newlist->entries, &entry_dup->node);
577 LIST_ADDQ(&newlist->ord_entries, &entry_dup->by_crtlist);
578 LIST_ADDQ(&ckchs->crtlist_entry, &entry_dup->by_ckch_store);
579
580 entry_dup = NULL; /* the entry was used, we need a new one next round */
581 }
582 }
583 }
584 }
William Lallemand6e9556b2020-05-12 17:52:44 +0200585 if (cfgerr & ERR_CODE)
586 goto error;
587
William Lallemand6e9556b2020-05-12 17:52:44 +0200588 entry = NULL;
589 }
590 if (cfgerr & ERR_CODE)
591 goto error;
592
593 newlist->linecount = linenum;
594
595 fclose(f);
596 *crtlist = newlist;
597
598 return cfgerr;
599error:
600 crtlist_entry_free(entry);
601
602 fclose(f);
603 crtlist_free(newlist);
604 return cfgerr;
605}
606
607/* This function reads a directory and stores it in a struct crtlist, each file is a crtlist_entry structure
608 * Fill the <crtlist> argument with a pointer to a new crtlist struct
609 *
610 * This function tries to open and store certificate files.
611 */
612int crtlist_load_cert_dir(char *path, struct bind_conf *bind_conf, struct crtlist **crtlist, char **err)
613{
614 struct crtlist *dir;
615 struct dirent **de_list;
616 int i, n;
617 struct stat buf;
618 char *end;
619 char fp[MAXPATHLEN+1];
620 int cfgerr = 0;
621 struct ckch_store *ckchs;
William Lallemand6e9556b2020-05-12 17:52:44 +0200622
623 dir = crtlist_new(path, 1);
624 if (dir == NULL) {
625 memprintf(err, "not enough memory");
626 return ERR_ALERT | ERR_FATAL;
627 }
628
629 n = scandir(path, &de_list, 0, alphasort);
630 if (n < 0) {
631 memprintf(err, "%sunable to scan directory '%s' : %s.\n",
632 err && *err ? *err : "", path, strerror(errno));
633 cfgerr |= ERR_ALERT | ERR_FATAL;
634 }
635 else {
636 for (i = 0; i < n; i++) {
637 struct crtlist_entry *entry;
638 struct dirent *de = de_list[i];
639
640 end = strrchr(de->d_name, '.');
641 if (end && (!strcmp(end, ".issuer") || !strcmp(end, ".ocsp") || !strcmp(end, ".sctl") || !strcmp(end, ".key")))
642 goto ignore_entry;
643
644 snprintf(fp, sizeof(fp), "%s/%s", path, de->d_name);
645 if (stat(fp, &buf) != 0) {
646 memprintf(err, "%sunable to stat SSL certificate from file '%s' : %s.\n",
647 err && *err ? *err : "", fp, strerror(errno));
648 cfgerr |= ERR_ALERT | ERR_FATAL;
649 goto ignore_entry;
650 }
651 if (!S_ISREG(buf.st_mode))
652 goto ignore_entry;
653
654 entry = crtlist_entry_new();
655 if (entry == NULL) {
656 memprintf(err, "not enough memory '%s'", fp);
657 cfgerr |= ERR_ALERT | ERR_FATAL;
658 goto ignore_entry;
659 }
660
William Lallemand6e9556b2020-05-12 17:52:44 +0200661 ckchs = ckchs_lookup(fp);
662 if (ckchs == NULL)
William Lallemandbd8e6ed2020-09-16 16:08:08 +0200663 ckchs = ckchs_load_cert_file(fp, err);
William Lallemand6e9556b2020-05-12 17:52:44 +0200664 if (ckchs == NULL) {
665 free(de);
666 free(entry);
667 cfgerr |= ERR_ALERT | ERR_FATAL;
668 goto end;
669 }
670 entry->node.key = ckchs;
671 entry->crtlist = dir;
672 LIST_ADDQ(&ckchs->crtlist_entry, &entry->by_ckch_store);
673 LIST_ADDQ(&dir->ord_entries, &entry->by_crtlist);
674 ebpt_insert(&dir->entries, &entry->node);
675
676ignore_entry:
677 free(de);
678 }
679end:
680 free(de_list);
681 }
682
683 if (cfgerr & ERR_CODE) {
684 /* free the dir and entries on error */
685 crtlist_free(dir);
686 } else {
687 *crtlist = dir;
688 }
689 return cfgerr;
690
691}
692
William Lallemandc756bbd2020-05-13 17:23:59 +0200693/*
694 * Take an ssl_bind_conf structure and append the configuration line used to
695 * create it in the buffer
696 */
697static void dump_crtlist_sslconf(struct buffer *buf, const struct ssl_bind_conf *conf)
698{
699 int space = 0;
700
701 if (conf == NULL)
702 return;
703
704 chunk_appendf(buf, " [");
705#ifdef OPENSSL_NPN_NEGOTIATED
706 if (conf->npn_str) {
707 int len = conf->npn_len;
708 char *ptr = conf->npn_str;
709 int comma = 0;
710
711 if (space) chunk_appendf(buf, " ");
712 chunk_appendf(buf, "npn ");
713 while (len) {
714 unsigned short size;
715
716 size = *ptr;
717 ptr++;
718 if (comma)
719 chunk_memcat(buf, ",", 1);
720 chunk_memcat(buf, ptr, size);
721 ptr += size;
722 len -= size + 1;
723 comma = 1;
724 }
725 chunk_memcat(buf, "", 1); /* finish with a \0 */
726 space++;
727 }
728#endif
729#ifdef TLSEXT_TYPE_application_layer_protocol_negotiation
730 if (conf->alpn_str) {
731 int len = conf->alpn_len;
732 char *ptr = conf->alpn_str;
733 int comma = 0;
734
735 if (space) chunk_appendf(buf, " ");
736 chunk_appendf(buf, "alpn ");
737 while (len) {
738 unsigned short size;
739
740 size = *ptr;
741 ptr++;
742 if (comma)
743 chunk_memcat(buf, ",", 1);
744 chunk_memcat(buf, ptr, size);
745 ptr += size;
746 len -= size + 1;
747 comma = 1;
748 }
749 chunk_memcat(buf, "", 1); /* finish with a \0 */
750 space++;
751 }
752#endif
753 /* verify */
754 {
755 if (conf->verify == SSL_SOCK_VERIFY_NONE) {
756 if (space) chunk_appendf(buf, " ");
757 chunk_appendf(buf, "verify none");
758 space++;
759 } else if (conf->verify == SSL_SOCK_VERIFY_OPTIONAL) {
760 if (space) chunk_appendf(buf, " ");
761 chunk_appendf(buf, "verify optional");
762 space++;
763 } else if (conf->verify == SSL_SOCK_VERIFY_REQUIRED) {
764 if (space) chunk_appendf(buf, " ");
765 chunk_appendf(buf, "verify required");
766 space++;
767 }
768 }
769
770 if (conf->no_ca_names) {
771 if (space) chunk_appendf(buf, " ");
772 chunk_appendf(buf, "no-ca-names");
773 space++;
774 }
775
776 if (conf->early_data) {
777 if (space) chunk_appendf(buf, " ");
778 chunk_appendf(buf, "allow-0rtt");
779 space++;
780 }
781 if (conf->ca_file) {
782 if (space) chunk_appendf(buf, " ");
783 chunk_appendf(buf, "ca-file %s", conf->ca_file);
784 space++;
785 }
786 if (conf->crl_file) {
787 if (space) chunk_appendf(buf, " ");
788 chunk_appendf(buf, "crl-file %s", conf->crl_file);
789 space++;
790 }
791 if (conf->ciphers) {
792 if (space) chunk_appendf(buf, " ");
793 chunk_appendf(buf, "ciphers %s", conf->ciphers);
794 space++;
795 }
796#if (HA_OPENSSL_VERSION_NUMBER >= 0x10101000L && !defined OPENSSL_IS_BORINGSSL && !defined LIBRESSL_VERSION_NUMBER)
797 if (conf->ciphersuites) {
798 if (space) chunk_appendf(buf, " ");
799 chunk_appendf(buf, "ciphersuites %s", conf->ciphersuites);
800 space++;
801 }
802#endif
803 if (conf->curves) {
804 if (space) chunk_appendf(buf, " ");
805 chunk_appendf(buf, "curves %s", conf->curves);
806 space++;
807 }
808 if (conf->ecdhe) {
809 if (space) chunk_appendf(buf, " ");
810 chunk_appendf(buf, "ecdhe %s", conf->ecdhe);
811 space++;
812 }
813
814 /* the crt-lists only support ssl-min-ver and ssl-max-ver */
William Lallemand8177ad92020-05-20 16:49:02 +0200815 if (conf->ssl_methods_cfg.min) {
William Lallemandc756bbd2020-05-13 17:23:59 +0200816 if (space) chunk_appendf(buf, " ");
William Lallemand8177ad92020-05-20 16:49:02 +0200817 chunk_appendf(buf, "ssl-min-ver %s", methodVersions[conf->ssl_methods_cfg.min].name);
William Lallemandc756bbd2020-05-13 17:23:59 +0200818 space++;
819 }
820
William Lallemand8177ad92020-05-20 16:49:02 +0200821 if (conf->ssl_methods_cfg.max) {
William Lallemandc756bbd2020-05-13 17:23:59 +0200822 if (space) chunk_appendf(buf, " ");
William Lallemand8177ad92020-05-20 16:49:02 +0200823 chunk_appendf(buf, "ssl-max-ver %s", methodVersions[conf->ssl_methods_cfg.max].name);
William Lallemandc756bbd2020-05-13 17:23:59 +0200824 space++;
825 }
826
827 chunk_appendf(buf, "]");
828
829 return;
830}
831
832/* dump a list of filters */
833static void dump_crtlist_filters(struct buffer *buf, struct crtlist_entry *entry)
834{
835 int i;
836
837 if (!entry->fcount)
838 return;
839
840 for (i = 0; i < entry->fcount; i++) {
841 chunk_appendf(buf, " %s", entry->filters[i]);
842 }
843 return;
844}
845
846/************************** CLI functions ****************************/
847
848
849/* CLI IO handler for '(show|dump) ssl crt-list' */
850static int cli_io_handler_dump_crtlist(struct appctx *appctx)
851{
852 struct buffer *trash = alloc_trash_chunk();
853 struct stream_interface *si = appctx->owner;
854 struct ebmb_node *lnode;
855
856 if (trash == NULL)
857 return 1;
858
859 /* dump the list of crt-lists */
860 lnode = appctx->ctx.cli.p1;
861 if (lnode == NULL)
862 lnode = ebmb_first(&crtlists_tree);
863 while (lnode) {
864 chunk_appendf(trash, "%s\n", lnode->key);
865 if (ci_putchk(si_ic(si), trash) == -1) {
866 si_rx_room_blk(si);
867 goto yield;
868 }
869 lnode = ebmb_next(lnode);
870 }
871 free_trash_chunk(trash);
872 return 1;
873yield:
874 appctx->ctx.cli.p1 = lnode;
875 free_trash_chunk(trash);
876 return 0;
877}
878
879/* CLI IO handler for '(show|dump) ssl crt-list <filename>' */
880static int cli_io_handler_dump_crtlist_entries(struct appctx *appctx)
881{
882 struct buffer *trash = alloc_trash_chunk();
883 struct crtlist *crtlist;
884 struct stream_interface *si = appctx->owner;
885 struct crtlist_entry *entry;
886
887 if (trash == NULL)
888 return 1;
889
890 crtlist = ebmb_entry(appctx->ctx.cli.p0, struct crtlist, node);
891
892 entry = appctx->ctx.cli.p1;
893 if (entry == NULL) {
894 entry = LIST_ELEM((crtlist->ord_entries).n, typeof(entry), by_crtlist);
895 chunk_appendf(trash, "# %s\n", crtlist->node.key);
896 if (ci_putchk(si_ic(si), trash) == -1) {
897 si_rx_room_blk(si);
898 goto yield;
899 }
900 }
901
902 list_for_each_entry_from(entry, &crtlist->ord_entries, by_crtlist) {
903 struct ckch_store *store;
904 const char *filename;
905
906 store = entry->node.key;
907 filename = store->path;
908 chunk_appendf(trash, "%s", filename);
909 if (appctx->ctx.cli.i0 == 's') /* show */
910 chunk_appendf(trash, ":%d", entry->linenum);
911 dump_crtlist_sslconf(trash, entry->ssl_conf);
912 dump_crtlist_filters(trash, entry);
913 chunk_appendf(trash, "\n");
914
915 if (ci_putchk(si_ic(si), trash) == -1) {
916 si_rx_room_blk(si);
917 goto yield;
918 }
919 }
920 free_trash_chunk(trash);
921 return 1;
922yield:
923 appctx->ctx.cli.p1 = entry;
924 free_trash_chunk(trash);
925 return 0;
926}
927
928/* CLI argument parser for '(show|dump) ssl crt-list' */
929static int cli_parse_dump_crtlist(char **args, char *payload, struct appctx *appctx, void *private)
930{
931 struct ebmb_node *lnode;
932 char *filename = NULL;
933 int mode;
William Lallemand99cc2182020-06-25 15:19:51 +0200934 char *end;
William Lallemandc756bbd2020-05-13 17:23:59 +0200935
936 if (!cli_has_level(appctx, ACCESS_LVL_ADMIN))
937 return 1;
938
939 appctx->ctx.cli.p0 = NULL;
940 appctx->ctx.cli.p1 = NULL;
941
942 if (*args[3] && !strcmp(args[3], "-n")) {
943 mode = 's';
944 filename = args[4];
945 } else {
946 mode = 'd';
947 filename = args[3];
948 }
949
950 if (mode == 's' && !*args[4])
951 return cli_err(appctx, "'show ssl crt-list -n' expects a filename or a directory\n");
952
953 if (filename && *filename) {
William Lallemand99cc2182020-06-25 15:19:51 +0200954
955
956 /* strip trailing slashes, including first one */
957 for (end = filename + strlen(filename) - 1; end >= filename && *end == '/'; end--)
958 *end = 0;
959
William Lallemandc756bbd2020-05-13 17:23:59 +0200960 lnode = ebst_lookup(&crtlists_tree, filename);
961 if (lnode == NULL)
962 return cli_err(appctx, "didn't find the specified filename\n");
963
964 appctx->ctx.cli.p0 = lnode;
965 appctx->io_handler = cli_io_handler_dump_crtlist_entries;
966 }
967 appctx->ctx.cli.i0 = mode;
968
969 return 0;
970}
971
972/* release function of the "add ssl crt-list' command, free things and unlock
973 the spinlock */
974static void cli_release_add_crtlist(struct appctx *appctx)
975{
976 struct crtlist_entry *entry = appctx->ctx.cli.p1;
977
978 if (appctx->st2 != SETCERT_ST_FIN) {
979 struct ckch_inst *inst, *inst_s;
980 /* upon error free the ckch_inst and everything inside */
981 ebpt_delete(&entry->node);
982 LIST_DEL(&entry->by_crtlist);
983 LIST_DEL(&entry->by_ckch_store);
984
985 list_for_each_entry_safe(inst, inst_s, &entry->ckch_inst, by_ckchs) {
986 ckch_inst_free(inst);
987 }
988 crtlist_free_filters(entry->filters);
989 ssl_sock_free_ssl_conf(entry->ssl_conf);
990 free(entry->ssl_conf);
991 free(entry);
992 }
993
994 HA_SPIN_UNLOCK(CKCH_LOCK, &ckch_lock);
995}
996
997
998/* IO Handler for the "add ssl crt-list" command It adds a new entry in the
999 * crt-list and generates the ckch_insts for each bind_conf that uses this crt-list
1000 *
1001 * The logic is the same as the "commit ssl cert" command but without the
1002 * freeing of the old structures, because there are none.
1003 */
1004static int cli_io_handler_add_crtlist(struct appctx *appctx)
1005{
1006 struct bind_conf_list *bind_conf_node;
1007 struct stream_interface *si = appctx->owner;
1008 struct crtlist *crtlist = appctx->ctx.cli.p0;
1009 struct crtlist_entry *entry = appctx->ctx.cli.p1;
1010 struct ckch_store *store = entry->node.key;
1011 struct buffer *trash = alloc_trash_chunk();
1012 struct ckch_inst *new_inst;
1013 char *err = NULL;
1014 int i = 0;
1015 int errcode = 0;
1016
1017 if (trash == NULL)
1018 goto error;
1019
1020 /* for each bind_conf which use the crt-list, a new ckch_inst must be
1021 * created.
1022 */
1023 if (unlikely(si_ic(si)->flags & (CF_WRITE_ERROR|CF_SHUTW)))
1024 goto error;
1025
1026 while (1) {
1027 switch (appctx->st2) {
1028 case SETCERT_ST_INIT:
1029 /* This state just print the update message */
1030 chunk_printf(trash, "Inserting certificate '%s' in crt-list '%s'", store->path, crtlist->node.key);
1031 if (ci_putchk(si_ic(si), trash) == -1) {
1032 si_rx_room_blk(si);
1033 goto yield;
1034 }
1035 appctx->st2 = SETCERT_ST_GEN;
1036 /* fallthrough */
1037 case SETCERT_ST_GEN:
1038 bind_conf_node = appctx->ctx.cli.p2; /* get the previous ptr from the yield */
1039 if (bind_conf_node == NULL)
1040 bind_conf_node = crtlist->bind_conf;
1041 for (; bind_conf_node; bind_conf_node = bind_conf_node->next) {
1042 struct bind_conf *bind_conf = bind_conf_node->bind_conf;
1043 struct sni_ctx *sni;
1044
1045 /* yield every 10 generations */
1046 if (i > 10) {
1047 appctx->ctx.cli.p2 = bind_conf_node;
1048 goto yield;
1049 }
1050
1051 /* we don't support multi-cert bundles, only simple ones */
1052 errcode |= ckch_inst_new_load_store(store->path, store, bind_conf, entry->ssl_conf, entry->filters, entry->fcount, &new_inst, &err);
1053 if (errcode & ERR_CODE)
1054 goto error;
1055
1056 /* we need to initialize the SSL_CTX generated */
1057 /* this iterate on the newly generated SNIs in the new instance to prepare their SSL_CTX */
1058 list_for_each_entry(sni, &new_inst->sni_ctx, by_ckch_inst) {
1059 if (!sni->order) { /* we initialized only the first SSL_CTX because it's the same in the other sni_ctx's */
1060 errcode |= ssl_sock_prepare_ctx(bind_conf, new_inst->ssl_conf, sni->ctx, &err);
1061 if (errcode & ERR_CODE)
1062 goto error;
1063 }
1064 }
1065 /* display one dot for each new instance */
1066 chunk_appendf(trash, ".");
1067 i++;
1068 LIST_ADDQ(&store->ckch_inst, &new_inst->by_ckchs);
William Lallemand9ab8f8d2020-06-24 01:00:52 +02001069 LIST_ADDQ(&entry->ckch_inst, &new_inst->by_crtlist_entry);
1070 new_inst->crtlist_entry = entry;
William Lallemandc756bbd2020-05-13 17:23:59 +02001071 }
1072 appctx->st2 = SETCERT_ST_INSERT;
1073 /* fallthrough */
1074 case SETCERT_ST_INSERT:
1075 /* insert SNIs in bind_conf */
1076 list_for_each_entry(new_inst, &store->ckch_inst, by_ckchs) {
1077 HA_RWLOCK_WRLOCK(SNI_LOCK, &new_inst->bind_conf->sni_lock);
1078 ssl_sock_load_cert_sni(new_inst, new_inst->bind_conf);
1079 HA_RWLOCK_WRUNLOCK(SNI_LOCK, &new_inst->bind_conf->sni_lock);
1080 }
1081 entry->linenum = ++crtlist->linecount;
1082 appctx->st2 = SETCERT_ST_FIN;
1083 goto end;
1084 }
1085 }
1086
1087end:
1088 chunk_appendf(trash, "\n");
1089 if (errcode & ERR_WARN)
1090 chunk_appendf(trash, "%s", err);
1091 chunk_appendf(trash, "Success!\n");
1092 if (ci_putchk(si_ic(si), trash) == -1)
1093 si_rx_room_blk(si);
1094 free_trash_chunk(trash);
1095 /* success: call the release function and don't come back */
1096 return 1;
1097yield:
1098 /* store the state */
1099 if (ci_putchk(si_ic(si), trash) == -1)
1100 si_rx_room_blk(si);
1101 free_trash_chunk(trash);
1102 si_rx_endp_more(si); /* let's come back later */
1103 return 0; /* should come back */
1104
1105error:
1106 /* spin unlock and free are done in the release function */
1107 if (trash) {
1108 chunk_appendf(trash, "\n%sFailed!\n", err);
1109 if (ci_putchk(si_ic(si), trash) == -1)
1110 si_rx_room_blk(si);
1111 free_trash_chunk(trash);
1112 }
1113 /* error: call the release function and don't come back */
1114 return 1;
1115}
1116
1117
1118/*
1119 * Parse a "add ssl crt-list <crt-list> <certfile>" line.
1120 * Filters and option must be passed through payload:
1121 */
1122static int cli_parse_add_crtlist(char **args, char *payload, struct appctx *appctx, void *private)
1123{
1124 int cfgerr = 0;
1125 struct ckch_store *store;
1126 char *err = NULL;
1127 char path[MAXPATHLEN+1];
1128 char *crtlist_path;
1129 char *cert_path = NULL;
1130 struct ebmb_node *eb;
1131 struct ebpt_node *inserted;
1132 struct crtlist *crtlist;
1133 struct crtlist_entry *entry = NULL;
William Lallemand99cc2182020-06-25 15:19:51 +02001134 char *end;
William Lallemandc756bbd2020-05-13 17:23:59 +02001135
1136 if (!cli_has_level(appctx, ACCESS_LVL_ADMIN))
1137 return 1;
1138
1139 if (!*args[3] || (!payload && !*args[4]))
1140 return cli_err(appctx, "'add ssl crtlist' expects a filename and a certificate name\n");
1141
1142 crtlist_path = args[3];
1143
William Lallemand99cc2182020-06-25 15:19:51 +02001144 /* strip trailing slashes, including first one */
1145 for (end = crtlist_path + strlen(crtlist_path) - 1; end >= crtlist_path && *end == '/'; end--)
1146 *end = 0;
1147
William Lallemandc756bbd2020-05-13 17:23:59 +02001148 if (HA_SPIN_TRYLOCK(CKCH_LOCK, &ckch_lock))
1149 return cli_err(appctx, "Operations on certificates are currently locked!\n");
1150
1151 eb = ebst_lookup(&crtlists_tree, crtlist_path);
1152 if (!eb) {
1153 memprintf(&err, "crt-list '%s' does not exist!", crtlist_path);
1154 goto error;
1155 }
1156 crtlist = ebmb_entry(eb, struct crtlist, node);
1157
1158 entry = crtlist_entry_new();
1159 if (entry == NULL) {
1160 memprintf(&err, "Not enough memory!");
1161 goto error;
1162 }
1163
1164 if (payload) {
1165 char *lf;
1166
1167 lf = strrchr(payload, '\n');
1168 if (lf) {
1169 memprintf(&err, "only one line of payload is supported!");
1170 goto error;
1171 }
1172 /* cert_path is filled here */
1173 cfgerr |= crtlist_parse_line(payload, &cert_path, entry, "CLI", 1, &err);
1174 if (cfgerr & ERR_CODE)
1175 goto error;
1176 } else {
1177 cert_path = args[4];
1178 }
1179
1180 if (!cert_path) {
1181 memprintf(&err, "'add ssl crtlist' should contain the certificate name in the payload");
1182 cfgerr |= ERR_ALERT | ERR_FATAL;
1183 goto error;
1184 }
1185
1186 if (eb_gettag(crtlist->entries.b[EB_RGHT])) {
1187 char *slash;
1188
1189 slash = strrchr(cert_path, '/');
1190 if (!slash) {
1191 memprintf(&err, "'%s' is a directory, certificate path '%s' must contain the directory path", (char *)crtlist->node.key, cert_path);
1192 goto error;
1193 }
1194 /* temporary replace / by 0 to do an strcmp */
1195 *slash = '\0';
1196 if (strcmp(cert_path, (char*)crtlist->node.key) != 0) {
1197 *slash = '/';
1198 memprintf(&err, "'%s' is a directory, certificate path '%s' must contain the directory path", (char *)crtlist->node.key, cert_path);
1199 goto error;
1200 }
1201 *slash = '/';
1202 }
1203
1204 if (*cert_path != '/' && global_ssl.crt_base) {
1205 if ((strlen(global_ssl.crt_base) + 1 + strlen(cert_path)) > MAXPATHLEN) {
1206 memprintf(&err, "'%s' : path too long", cert_path);
1207 cfgerr |= ERR_ALERT | ERR_FATAL;
1208 goto error;
1209 }
1210 snprintf(path, sizeof(path), "%s/%s", global_ssl.crt_base, cert_path);
1211 cert_path = path;
1212 }
1213
1214 store = ckchs_lookup(cert_path);
1215 if (store == NULL) {
1216 memprintf(&err, "certificate '%s' does not exist!", cert_path);
1217 goto error;
1218 }
William Lallemandc756bbd2020-05-13 17:23:59 +02001219 if (store->ckch == NULL || store->ckch->cert == NULL) {
1220 memprintf(&err, "certificate '%s' is empty!", cert_path);
1221 goto error;
1222 }
1223
1224 /* check if it's possible to insert this new crtlist_entry */
1225 entry->node.key = store;
1226 inserted = ebpt_insert(&crtlist->entries, &entry->node);
1227 if (inserted != &entry->node) {
1228 memprintf(&err, "file already exists in this directory!");
1229 goto error;
1230 }
1231
1232 /* this is supposed to be a directory (EB_ROOT_UNIQUE), so no ssl_conf are allowed */
1233 if ((entry->ssl_conf || entry->filters) && eb_gettag(crtlist->entries.b[EB_RGHT])) {
1234 memprintf(&err, "this is a directory, SSL configuration and filters are not allowed");
1235 goto error;
1236 }
1237
1238 LIST_ADDQ(&crtlist->ord_entries, &entry->by_crtlist);
1239 entry->crtlist = crtlist;
1240 LIST_ADDQ(&store->crtlist_entry, &entry->by_ckch_store);
1241
1242 appctx->st2 = SETCERT_ST_INIT;
1243 appctx->ctx.cli.p0 = crtlist;
1244 appctx->ctx.cli.p1 = entry;
1245
1246 /* unlock is done in the release handler */
1247 return 0;
1248
1249error:
1250 crtlist_entry_free(entry);
1251 HA_SPIN_UNLOCK(CKCH_LOCK, &ckch_lock);
1252 err = memprintf(&err, "Can't edit the crt-list: %s\n", err ? err : "");
1253 return cli_dynerr(appctx, err);
1254}
1255
1256/* Parse a "del ssl crt-list <crt-list> <certfile>" line. */
1257static int cli_parse_del_crtlist(char **args, char *payload, struct appctx *appctx, void *private)
1258{
1259 struct ckch_store *store;
1260 char *err = NULL;
1261 char *crtlist_path, *cert_path;
1262 struct ebmb_node *ebmb;
1263 struct ebpt_node *ebpt;
1264 struct crtlist *crtlist;
1265 struct crtlist_entry *entry = NULL;
1266 struct ckch_inst *inst, *inst_s;
1267 int linenum = 0;
1268 char *colons;
William Lallemand99cc2182020-06-25 15:19:51 +02001269 char *end;
William Lallemandc756bbd2020-05-13 17:23:59 +02001270
1271 if (!cli_has_level(appctx, ACCESS_LVL_ADMIN))
1272 return 1;
1273
1274 if (!*args[3] || !*args[4])
1275 return cli_err(appctx, "'del ssl crtlist' expects a filename and a certificate name\n");
1276
1277 if (HA_SPIN_TRYLOCK(CKCH_LOCK, &ckch_lock))
1278 return cli_err(appctx, "Can't delete!\nOperations on certificates are currently locked!\n");
1279
1280 crtlist_path = args[3];
1281 cert_path = args[4];
1282
1283 colons = strchr(cert_path, ':');
1284 if (colons) {
1285 char *endptr;
1286
1287 linenum = strtol(colons + 1, &endptr, 10);
1288 if (colons + 1 == endptr || *endptr != '\0') {
1289 memprintf(&err, "wrong line number after colons in '%s'!", cert_path);
1290 goto error;
1291 }
1292 *colons = '\0';
1293 }
William Lallemand99cc2182020-06-25 15:19:51 +02001294
1295 /* strip trailing slashes, including first one */
1296 for (end = crtlist_path + strlen(crtlist_path) - 1; end >= crtlist_path && *end == '/'; end--)
1297 *end = 0;
1298
William Lallemandc756bbd2020-05-13 17:23:59 +02001299 /* look for crtlist */
1300 ebmb = ebst_lookup(&crtlists_tree, crtlist_path);
1301 if (!ebmb) {
1302 memprintf(&err, "crt-list '%s' does not exist!", crtlist_path);
1303 goto error;
1304 }
1305 crtlist = ebmb_entry(ebmb, struct crtlist, node);
1306
1307 /* look for store */
1308 store = ckchs_lookup(cert_path);
1309 if (store == NULL) {
1310 memprintf(&err, "certificate '%s' does not exist!", cert_path);
1311 goto error;
1312 }
William Lallemandc756bbd2020-05-13 17:23:59 +02001313 if (store->ckch == NULL || store->ckch->cert == NULL) {
1314 memprintf(&err, "certificate '%s' is empty!", cert_path);
1315 goto error;
1316 }
1317
1318 ebpt = ebpt_lookup(&crtlist->entries, store);
1319 if (!ebpt) {
1320 memprintf(&err, "certificate '%s' can't be found in crt-list '%s'!", cert_path, crtlist_path);
1321 goto error;
1322 }
1323
1324 /* list the line number of entries for errors in err, and select the right ebpt */
1325 for (; ebpt; ebpt = ebpt_next_dup(ebpt)) {
1326 struct crtlist_entry *tmp;
1327
1328 tmp = ebpt_entry(ebpt, struct crtlist_entry, node);
1329 memprintf(&err, "%s%s%d", err ? err : "", err ? ", " : "", tmp->linenum);
1330
1331 /* select the entry we wanted */
1332 if (linenum == 0 || tmp->linenum == linenum) {
1333 if (!entry)
1334 entry = tmp;
1335 }
1336 }
1337
1338 /* we didn't found the specified entry */
1339 if (!entry) {
1340 memprintf(&err, "found a certificate '%s' but the line number is incorrect, please specify a correct line number preceded by colons (%s)!", cert_path, err ? err : NULL);
1341 goto error;
1342 }
1343
1344 /* we didn't specified a line number but there were several entries */
1345 if (linenum == 0 && ebpt_next_dup(&entry->node)) {
1346 memprintf(&err, "found the certificate '%s' in several entries, please specify a line number preceded by colons (%s)!", cert_path, err ? err : NULL);
1347 goto error;
1348 }
1349
1350 /* upon error free the ckch_inst and everything inside */
1351
1352 ebpt_delete(&entry->node);
1353 LIST_DEL(&entry->by_crtlist);
1354 LIST_DEL(&entry->by_ckch_store);
1355
1356 list_for_each_entry_safe(inst, inst_s, &entry->ckch_inst, by_crtlist_entry) {
1357 struct sni_ctx *sni, *sni_s;
1358
1359 HA_RWLOCK_WRLOCK(SNI_LOCK, &inst->bind_conf->sni_lock);
1360 list_for_each_entry_safe(sni, sni_s, &inst->sni_ctx, by_ckch_inst) {
1361 ebmb_delete(&sni->name);
1362 LIST_DEL(&sni->by_ckch_inst);
1363 SSL_CTX_free(sni->ctx);
1364 free(sni);
1365 }
1366 HA_RWLOCK_WRUNLOCK(SNI_LOCK, &inst->bind_conf->sni_lock);
1367 LIST_DEL(&inst->by_ckchs);
1368 free(inst);
1369 }
1370
1371 crtlist_free_filters(entry->filters);
1372 ssl_sock_free_ssl_conf(entry->ssl_conf);
1373 free(entry->ssl_conf);
1374 free(entry);
1375
1376 HA_SPIN_UNLOCK(CKCH_LOCK, &ckch_lock);
1377 err = memprintf(&err, "Entry '%s' deleted in crtlist '%s'!\n", cert_path, crtlist_path);
1378 return cli_dynmsg(appctx, LOG_NOTICE, err);
1379
1380error:
1381 HA_SPIN_UNLOCK(CKCH_LOCK, &ckch_lock);
1382 err = memprintf(&err, "Can't delete the entry: %s\n", err ? err : "");
1383 return cli_dynerr(appctx, err);
1384}
1385
1386
William Lallemandee8530c2020-06-23 18:19:42 +02001387/* unlink and free all crt-list and crt-list entries */
1388void crtlist_deinit()
1389{
1390 struct eb_node *node, *next;
1391 struct crtlist *crtlist;
1392
1393 node = eb_first(&crtlists_tree);
1394 while (node) {
1395 next = eb_next(node);
1396 crtlist = ebmb_entry(node, struct crtlist, node);
1397 crtlist_free(crtlist);
1398 node = next;
1399 }
1400}
1401
William Lallemandc756bbd2020-05-13 17:23:59 +02001402
1403/* register cli keywords */
1404static struct cli_kw_list cli_kws = {{ },{
1405 { { "add", "ssl", "crt-list", NULL }, "add ssl crt-list <filename> <certfile> [options] : add a line <certfile> to a crt-list <filename>", cli_parse_add_crtlist, cli_io_handler_add_crtlist, cli_release_add_crtlist },
1406 { { "del", "ssl", "crt-list", NULL }, "del ssl crt-list <filename> <certfile[:line]> : delete a line <certfile> in a crt-list <filename>", cli_parse_del_crtlist, NULL, NULL },
1407 { { "show", "ssl", "crt-list", NULL }, "show ssl crt-list [-n] [<filename>] : show the list of crt-lists or the content of a crt-list <filename>", cli_parse_dump_crtlist, cli_io_handler_dump_crtlist, NULL },
1408 { { NULL }, NULL, NULL, NULL } }
1409};
1410
1411INITCALL1(STG_REGISTER, cli_register_kw, &cli_kws);
1412