Hello,
On Thu, 2021-04-01 at 16:03 +0200, William Lallemand wrote:
> On Thu, Apr 01, 2021 at 02:26:07PM +0200, William Lallemand wrote:
> > On Thu, Apr 01, 2021 at 10:19:31AM +0000, Jarno Huuskonen wrote:
> > > Hello,
> > >
> > > I'm seeing a regression with 2.2.12 and using rsa and ecdsa certs on
> > > bind.
> > > (cert1.pem.ecdsa
> > > cert1.pem.ecdsa.ocsp
> > > cert1.pem.ocsp
> > > cert1.pem.rsa
> > > cert1.pem.rsa.ocsp
> > > )
> > >
> >
> > Thanks for the report, I can reproduce the problem, I'm investigating.
> >
>
> Could you try the attached patch?
Thanks William, with 2.2.12 + patch haproxy starts and serves both rsa/ecdsa
certs.
I'm attaching a regtest patch that attempts to check that haproxy starts
with multi-bundle cert and serves both rsa/ecdsa certs.
(the test itself is not well tested so handle with care :)
(for example I'm not sure if ciphers ECDHE-RSA-AES128-GCM-SHA256 / ECDHE-
ECDSA-AES256-GCM-SHA384 are needed/usefull and work with boring/libressl).
-Jarno
--
Jarno Huuskonen
From b0aec4e620404ea38dae0fe50046ab0f2cb48398 Mon Sep 17 00:00:00 2001
From: Jarno Huuskonen <jarno.huusko...@uef.fi>
Date: Fri, 2 Apr 2021 09:39:39 +0300
Subject: [PATCH] REGTESTS: ssl: Minimal multi-bundle certificates bind check.
This adds minimal test to check that multi-bundle (rsa/ecdsa) bind
works (for BUG/MEDIUM: ssl: ckch_inst->ctx not assigned with
multi-bundle certificates) and both rsa/ecdsa certs are served.
---
reg-tests/ssl/rsa_and_ecdsa_bind.pem.ecdsa | 1 +
reg-tests/ssl/rsa_and_ecdsa_bind.pem.rsa | 1 +
reg-tests/ssl/set_ssl_cert.vtc | 31 ++++++++++++++++++++++
3 files changed, 33 insertions(+)
create mode 120000 reg-tests/ssl/rsa_and_ecdsa_bind.pem.ecdsa
create mode 120000 reg-tests/ssl/rsa_and_ecdsa_bind.pem.rsa
diff --git a/reg-tests/ssl/rsa_and_ecdsa_bind.pem.ecdsa b/reg-tests/ssl/rsa_and_ecdsa_bind.pem.ecdsa
new file mode 120000
index 000000000..16276ab88
--- /dev/null
+++ b/reg-tests/ssl/rsa_and_ecdsa_bind.pem.ecdsa
@@ -0,0 +1 @@
+ecdsa.pem
\ No newline at end of file
diff --git a/reg-tests/ssl/rsa_and_ecdsa_bind.pem.rsa b/reg-tests/ssl/rsa_and_ecdsa_bind.pem.rsa
new file mode 120000
index 000000000..1b7cb2c3c
--- /dev/null
+++ b/reg-tests/ssl/rsa_and_ecdsa_bind.pem.rsa
@@ -0,0 +1 @@
+common.pem
\ No newline at end of file
diff --git a/reg-tests/ssl/set_ssl_cert.vtc b/reg-tests/ssl/set_ssl_cert.vtc
index a606b477d..022e8d6c3 100644
--- a/reg-tests/ssl/set_ssl_cert.vtc
+++ b/reg-tests/ssl/set_ssl_cert.vtc
@@ -16,6 +16,9 @@
# any SNI. The test consists in checking that the used certificate is the right one after
# updating it via a "set ssl cert" call.
#
+# listen other-rsaecdsa-ssl / other-rsaecdsa checks that haproxy can bind and serve multi-bundle
+# (rsa/ecdsa) certificate.
+#
# If this test does not work anymore:
# - Check that you have socat
@@ -74,6 +77,21 @@ haproxy h1 -conf {
bind "${tmpdir}/other-ssl.sock" ssl crt-list ${testdir}/set_default_cert.crt-list
server s1 ${s1_addr}:${s1_port}
+ # check that we can bind with: rsa_and_ecdsa_bind.pem.rsa / rsa_and_ecdsa_bind.pem.ecdsa
+ listen other-rsaecdsa-ssl
+ bind "${tmpdir}/other-rsaecdsa-ssl.sock" ssl crt ${testdir}/rsa_and_ecdsa_bind.pem
+ http-request deny deny_status 200
+ server s1 ${s1_addr}:${s1_port}
+
+ # use other-rsa_ecdsa-ssl to check both rsa and ecdsa certs are returned
+ listen other-rsaecdsa
+ bind "fd@${otherrsaecdsa}"
+ http-response set-header X-SSL-Server-SHA1 %[ssl_s_sha1,hex]
+ use-server s1rsa if { path_end -i .rsa }
+ use-server s1ecdsa if { path_end -i .ecdsa }
+ server s1rsa "${tmpdir}/other-rsaecdsa-ssl.sock" ssl verify none force-tlsv12 sni str(www.test1.com) ciphers ECDHE-RSA-AES128-GCM-SHA256
+ server s1ecdsa "${tmpdir}/other-rsaecdsa-ssl.sock" ssl verify none force-tlsv12 sni str(localhost) ciphers ECDHE-ECDSA-AES256-GCM-SHA384
+
} -start
@@ -202,3 +220,16 @@ client c1 -connect ${h1_clearlst_sock} {
expect resp.http.X-SSL-Server-SHA1 == "9DC18799428875976DDE706E9956035EE88A4CB3"
expect resp.status == 200
} -run
+
+# Check that other-rsaecdsa serves both rsa and ecdsa certificate
+client c1 -connect ${h1_otherrsaecdsa_sock} {
+ txreq -req GET -url /dummy.rsa
+ rxresp
+ expect resp.http.X-SSL-Server-SHA1 == "2195C9F0FD58470313013FC27C1B9CF9864BD1C6"
+ expect resp.status == 200
+
+ txreq -req GET -url /dummy.ecdsa
+ rxresp
+ expect resp.http.X-SSL-Server-SHA1 == "A490D069DBAFBEE66DE434BEC34030ADE8BCCBF1"
+ expect resp.status == 200
+} -run
--
2.26.3
