From 984d2cfb61744bed29ce92cdc5360155cbd8ca44 Mon Sep 17 00:00:00 2001 From: William Lallemand Date: Tue, 29 Oct 2024 15:31:00 +0100 Subject: [PATCH] BUG/MINOR: ssl/cli: 'set ssl cert' does not check the transaction name correctly Since commit 089c13850f ("MEDIUM: ssl: ssl-load-extra-del-ext work only with .crt"), the 'set ssl cert' CLI command does not check correctly if the transaction you are trying to update is the right one. The consequence is that you could commit accidentaly a transaction on the wrong certificate. The fix introduces the check again in case you are not using ssl-load-extra-del-ext. This must be backported in all stable versions. --- src/ssl_ckch.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/ssl_ckch.c b/src/ssl_ckch.c index a2ba4b83e7..92ed13e65d 100644 --- a/src/ssl_ckch.c +++ b/src/ssl_ckch.c @@ -2600,7 +2600,7 @@ static int cli_parse_set_cert(char **args, char *payload, struct appctx *appctx, errcode |= ERR_ALERT | ERR_FATAL; goto end; } - + /* check again with the right extension */ if (strcmp(ckchs_transaction.path, buf->area) != 0) { /* remove .crt of the error message */ *(b_orig(buf) + b_data(buf) + strlen(".crt")) = '\0'; @@ -2610,6 +2610,11 @@ static int cli_parse_set_cert(char **args, char *payload, struct appctx *appctx, errcode |= ERR_ALERT | ERR_FATAL; goto end; } + } else { + /* without del-ext the error is definitive */ + memprintf(&err, "The ongoing transaction is about '%s' but you are trying to set '%s'\n", ckchs_transaction.path, buf->area); + errcode |= ERR_ALERT | ERR_FATAL; + goto end; } }