Skip to content

Commit 7be50be

Browse files
aiharosaiharos
committed
MEDIUM: protect from deleting ssl certs still in use
1 parent a18e0a6 commit 7be50be

File tree

6 files changed

+279
-2
lines changed

6 files changed

+279
-2
lines changed

‎e2e/tests/storage_ssl_certificates/3.pem‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
-----BEGIN PRIVATE KEY-----
2+
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC/ZGXoEmYgWL2m
3+
nd41cr1kRSPISmWw12o8vdGZP2OLoL8E2X8IFF6mIyNxakdhOYILBADGArCiNzYp
4+
f0XpxO0LsOWC8m7lckF+Dyyh7TSmQ5TcxxT8Bf5JxvZEAwM09FIZooVDy0vJeo3g
5+
xC08MIqtTaZbstyuRLKkigu75QWnun+qhgcxV9IMN8s/Ee6X5wFsneCvLHFgzELS
6+
9gcephLieBEfPLDpDh8mGnUgvEmyBJjDRz6cFYOEvsqW0D+6krUDe3ELnV20TFeY
7+
CrvBPZ+ZHFZWoSjE3ainpQHd9w0Kx4w0SIrYAs2AOC1qakkrh5QjFiky30DpJ6EU
8+
yg/eltW5AgMBAAECggEARk1RpXpEqzMNjstEWSupZ9CBwUuaqOenrWIoQHtpTFui
9+
btyZbdVVov8bQMjCKXNfUj6JLjLEwQE40uteOe1NCVNUKtJ0a7GZXv2h7mTcRwph
10+
/urdyWlGK8F6qibVIblxAtuQygM99mcfAGXvG8HU3q28IsjDiPvRBuFyR/VrK12R
11+
AY/cU5kADrRwLeswT8Clw7DhNhWEMcvAuS0R8liyXhQ8IG4WOZYIkBF3NI+GB3X+
12+
PE4SFZfk2CvbGSth1vvVKv7TAVczw81Ek6FJXV6A/XP3mFjuDqDU0NbEL4QQds2z
13+
S/0JpEzx5LurN/UEIAyf/u+iEtPc56oUdAXJpHfWFQKBgQD86aOJDADg9F3HAdvG
14+
Xkh60B6PZ63r6iw6wCsJD2olOl+XF7GdGXKGzCZQsz2fob1E4zhb8kduHNEPeBG7
15+
x5WyS7fqycRyz3oEyozz9KLcggfOU+yyuQ2kn/1O51/aiABlkinyj7ed/FL9jqeE
16+
LdUM6194QEPgQnghjYMj6UcHpwKBgQDBuoFsgmA1OvtuSpijnZ/0ueI9Lkh8Quk2
17+
HusTKglP4KnuRCKm60PRXxxsFNxQgxuXhxEgBuMwJo1RO+CLjzh540pFnAN235QZ
18+
F2FKio5hQT7olo8Weu6IEbLE5nzTDEcnuKZrmqEGFlsUXLBW3zYgn1PorWDRMvv6
19+
m+T4+NDjnwKBgDbKjwlDtnUFu8M/XdON3Xnt2JEMzxsK8mYP98LQuhgymz7qfSoh
20+
tzQIykw1aKZKrexcpXsV8++hApGtW3oo9P9ZdBDDgXG2DSM4lmzLlPTcnsBOYjsd
21+
6BzAJGqRqax4Rk266qeIBymM3pXb7+Ks4zkXTOmKUqok/E2YkM6Y3TCFAoGBALg2
22+
jscNmkpDkb4odMhwJB/jebvPfOGcBoKOF94bRMuNyEhmxcSPReebVz13AKAWa3BE
23+
4QXhRrsMjahHFZffUkak2IUkey7YHs1VLBBjfEwCbL1iHSG1N4hvu9v7h4pvzGF6
24+
9dSwLpnJPEY6dPvGOIQAvRstcji7EFwXTT1p68flAoGANxFyWNiCC0LZ1t+4aS4j
25+
cA7piBgu1bfc1LtL9wBj7LeCLW942S1yCcHd/YI3KMc8ZP8MkD2eKuMOCD48JVN7
26+
k1Pnh+V+/Bnin1owach62ckZjgubLQfbffiGmpEo3KqP4g8h7lst6Xbja1DatJ2Q
27+
Ml0WvPvs/l61lp1CI36UuUA=
28+
-----END PRIVATE KEY-----
29+
-----BEGIN CERTIFICATE-----
30+
MIICoDCCAYgCAhACMA0GCSqGSIb3DQEBCwUAMBMxETAPBgNVBAMMCEludGVybTIu
31+
MB4XDTIwMTEyNTEyMTIwNFoXDTIxMTEyNTEyMTIwNFowGDEWMBQGA1UEAwwNMS5l
32+
eGFtcGxlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL9kZegS
33+
ZiBYvaad3jVyvWRFI8hKZbDXajy90Zk/Y4ugvwTZfwgUXqYjI3FqR2E5ggsEAMYC
34+
sKI3Nil/RenE7Quw5YLybuVyQX4PLKHtNKZDlNzHFPwF/knG9kQDAzT0UhmihUPL
35+
S8l6jeDELTwwiq1Npluy3K5EsqSKC7vlBae6f6qGBzFX0gw3yz8R7pfnAWyd4K8s
36+
cWDMQtL2Bx6mEuJ4ER88sOkOHyYadSC8SbIEmMNHPpwVg4S+ypbQP7qStQN7cQud
37+
XbRMV5gKu8E9n5kcVlahKMTdqKelAd33DQrHjDRIitgCzYA4LWpqSSuHlCMWKTLf
38+
QOknoRTKD96W1bkCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAeeAoG3xpVfAcA2ZN
39+
aJA0uEB7ZH5BjhFsvmc1kEZylkEo6STVs1uTTvc9+v3PqzYANycbHy/3N0EUo5OX
40+
X6tfo3SMn3c8MyZu/3960Vcs1YJApdC1P3FvHj25IQGz8qLgsmION1tijg0ySPQb
41+
CYFXZ8T0ZYHA2X2QMieYiB9cNcmaL3Mlx04nf2Vfb+e/6kCWKkETlfSDIde9/J2M
42+
kVAYLGWWnwWvfRvjEaZ7SZNWslBttUTEr4PiFkvdPU01UF3VAjkcAOcDzvueGdmT
43+
d5Eg1BEWWmNBdT+Yg5hoy5Hx8R7H9ZcyoXnIMKCa9pOoIBIEk/hmcXj3smmjAMfO
44+
wTO08w==
45+
-----END CERTIFICATE-----
46+
-----BEGIN CERTIFICATE-----
47+
MIICsTCCAZmgAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwEjEQMA4GA1UEAwwHUm9v
48+
dC1jYTAeFw0yMDExMjUxMjEyMDRaFw0yMTExMjUxMjEyMDRaMBMxETAPBgNVBAMM
49+
CEludGVybTEuMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0/VPbQ2O
50+
YERPdfjLsTn/eGu4R98iNOw3pwyOtxK5b7w/b3sheGvoA7iRdyk6TBQ6e6sGUnUj
51+
fImyxNnWHRNBsX6NwwYk3DvFMvVgIfYi657m+7JaPYT+TcsLF223n2mDP3PHQe4B
52+
etOdP81gC2c+l1cmPSduMwzi3Ze64gQ15PvyTjVcTRuVCFZIpdAZ2DLEFMviuc7O
53+
vnxA+DFfN5Ve5gCJIEmxEtkHtolqZbhBIVPsfz5CofjD9bPm452ibssNoZgKU030
54+
9h2QPzvOhJ4iN2UDto2/Mq6xemEXxhVV7GyJ5iKtlnz1TYNAVPKkzhY+J9fnG/yT
55+
/MOwREaq+/9AbwIDAQABoxAwDjAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBCwUA
56+
A4IBAQCyqfVs2oawxgymfI/Nk6aGG+EjG+aBixu9tO45hQT2mEyb5ztP49ZwFOpc
57+
+ys1snq3gtol2r7J+Up96DJ3aF6U3OE3iDqbtfjosMmi+rQQDRK/hp6QcU5rQucY
58+
hDiooiuajp7bhUgEdjhDW7GbV9yT1bA9WL5urFoGE0THUKLoMV4GCRQAQsodEx+B
59+
yos50UBCHuSkeJWRGmR4lpyIprPJaQgC7E83FfLe5UDsP1bioDiW4RZk4sqryy/z
60+
VJQNGgXYnlftf6J6WOPLdzU51R21yGCRjmNP0G9Vay9Wq7WOdDqjiQjWZyXWFf6H
61+
bbp7qAgS2JLTieLZ3GXBg0RTi+lK
62+
-----END CERTIFICATE-----
63+
-----BEGIN CERTIFICATE-----
64+
MIICsjCCAZqgAwIBAgICEAEwDQYJKoZIhvcNAQELBQAwEzERMA8GA1UEAwwISW50
65+
ZXJtMS4wHhcNMjAxMTI1MTIxMjA0WhcNMjExMTI1MTIxMjA0WjATMREwDwYDVQQD
66+
DAhJbnRlcm0yLjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKto0lJW
67+
e+0+6u/gxG3NNfoqHWAMiDm+Ogcv1aIUTxTK8CO6dlwLTAMDg47wXgZSE+fpwtJf
68+
OCV9uwUvoVrdBazPil13KTQKHkN3jV6TnrU92gJpb1uBCQwQQXvCaQeUrMNPC7h3
69+
lYaxAODH62B5Pl2PY/DXdaKNbsN0chOZmNl87FgtXH4/ITOqqHY/vLW4ikYbADHi
70+
HLZOXFFV6VK6tNm5NgbKpDeUG5I5mjilZSfxnHHJAFIrIy19wK+wyPr9X+Eyph7Z
71+
slYDDZ/+RRIEp3tNlaac+g+uv1CJZWdRcTb+q/fAMd/emL0ofg3XKRNtSwfDuDNh
72+
z7i68VKL/6Xtd3cCAwEAAaMQMA4wDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsF
73+
AAOCAQEAYUwKKDKMG0ZwUJwJuqXZfCrf+95t9aeb+ALcFw7gABrdSFY9VmDQj2wW
74+
wl1afkV0jAREEnOtHJ0wioAhD86TUMoj99+UMEtp/r9QPH1XMClnCS0kp1M9ogCu
75+
PlqFamJlKhIa3xvvKSamU6G7qlbVzi2y7x/SBhK/U/FDo4bElgwG6WVXsluOQ6fT
76+
uUAJTqNfWcSdw2ntIGbwlbg1sco3a2JENB/5tyTSIWlwwUo6d+s2W3ZcNePWAPdr
77+
gEAVV1yOWsb1OVse2NRye5lH3cc+x0O1XYzWiC6G3GWYUmoPhl50fsidrd6WQIt5
78+
+6MXQJQW+CgBnPiCdSfN58mxv49xJQ==
79+
-----END CERTIFICATE-----

‎e2e/tests/storage_ssl_certificates/4.pem‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
-----BEGIN PRIVATE KEY-----
2+
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC/ZGXoEmYgWL2m
3+
nd41cr1kRSPISmWw12o8vdGZP2OLoL8E2X8IFF6mIyNxakdhOYILBADGArCiNzYp
4+
f0XpxO0LsOWC8m7lckF+Dyyh7TSmQ5TcxxT8Bf5JxvZEAwM09FIZooVDy0vJeo3g
5+
xC08MIqtTaZbstyuRLKkigu75QWnun+qhgcxV9IMN8s/Ee6X5wFsneCvLHFgzELS
6+
9gcephLieBEfPLDpDh8mGnUgvEmyBJjDRz6cFYOEvsqW0D+6krUDe3ELnV20TFeY
7+
CrvBPZ+ZHFZWoSjE3ainpQHd9w0Kx4w0SIrYAs2AOC1qakkrh5QjFiky30DpJ6EU
8+
yg/eltW5AgMBAAECggEARk1RpXpEqzMNjstEWSupZ9CBwUuaqOenrWIoQHtpTFui
9+
btyZbdVVov8bQMjCKXNfUj6JLjLEwQE40uteOe1NCVNUKtJ0a7GZXv2h7mTcRwph
10+
/urdyWlGK8F6qibVIblxAtuQygM99mcfAGXvG8HU3q28IsjDiPvRBuFyR/VrK12R
11+
AY/cU5kADrRwLeswT8Clw7DhNhWEMcvAuS0R8liyXhQ8IG4WOZYIkBF3NI+GB3X+
12+
PE4SFZfk2CvbGSth1vvVKv7TAVczw81Ek6FJXV6A/XP3mFjuDqDU0NbEL4QQds2z
13+
S/0JpEzx5LurN/UEIAyf/u+iEtPc56oUdAXJpHfWFQKBgQD86aOJDADg9F3HAdvG
14+
Xkh60B6PZ63r6iw6wCsJD2olOl+XF7GdGXKGzCZQsz2fob1E4zhb8kduHNEPeBG7
15+
x5WyS7fqycRyz3oEyozz9KLcggfOU+yyuQ2kn/1O51/aiABlkinyj7ed/FL9jqeE
16+
LdUM6194QEPgQnghjYMj6UcHpwKBgQDBuoFsgmA1OvtuSpijnZ/0ueI9Lkh8Quk2
17+
HusTKglP4KnuRCKm60PRXxxsFNxQgxuXhxEgBuMwJo1RO+CLjzh540pFnAN235QZ
18+
F2FKio5hQT7olo8Weu6IEbLE5nzTDEcnuKZrmqEGFlsUXLBW3zYgn1PorWDRMvv6
19+
m+T4+NDjnwKBgDbKjwlDtnUFu8M/XdON3Xnt2JEMzxsK8mYP98LQuhgymz7qfSoh
20+
tzQIykw1aKZKrexcpXsV8++hApGtW3oo9P9ZdBDDgXG2DSM4lmzLlPTcnsBOYjsd
21+
6BzAJGqRqax4Rk266qeIBymM3pXb7+Ks4zkXTOmKUqok/E2YkM6Y3TCFAoGBALg2
22+
jscNmkpDkb4odMhwJB/jebvPfOGcBoKOF94bRMuNyEhmxcSPReebVz13AKAWa3BE
23+
4QXhRrsMjahHFZffUkak2IUkey7YHs1VLBBjfEwCbL1iHSG1N4hvu9v7h4pvzGF6
24+
9dSwLpnJPEY6dPvGOIQAvRstcji7EFwXTT1p68flAoGANxFyWNiCC0LZ1t+4aS4j
25+
cA7piBgu1bfc1LtL9wBj7LeCLW942S1yCcHd/YI3KMc8ZP8MkD2eKuMOCD48JVN7
26+
k1Pnh+V+/Bnin1owach62ckZjgubLQfbffiGmpEo3KqP4g8h7lst6Xbja1DatJ2Q
27+
Ml0WvPvs/l61lp1CI36UuUA=
28+
-----END PRIVATE KEY-----
29+
-----BEGIN CERTIFICATE-----
30+
MIICoDCCAYgCAhACMA0GCSqGSIb3DQEBCwUAMBMxETAPBgNVBAMMCEludGVybTIu
31+
MB4XDTIwMTEyNTEyMTIwNFoXDTIxMTEyNTEyMTIwNFowGDEWMBQGA1UEAwwNMS5l
32+
eGFtcGxlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL9kZegS
33+
ZiBYvaad3jVyvWRFI8hKZbDXajy90Zk/Y4ugvwTZfwgUXqYjI3FqR2E5ggsEAMYC
34+
sKI3Nil/RenE7Quw5YLybuVyQX4PLKHtNKZDlNzHFPwF/knG9kQDAzT0UhmihUPL
35+
S8l6jeDELTwwiq1Npluy3K5EsqSKC7vlBae6f6qGBzFX0gw3yz8R7pfnAWyd4K8s
36+
cWDMQtL2Bx6mEuJ4ER88sOkOHyYadSC8SbIEmMNHPpwVg4S+ypbQP7qStQN7cQud
37+
XbRMV5gKu8E9n5kcVlahKMTdqKelAd33DQrHjDRIitgCzYA4LWpqSSuHlCMWKTLf
38+
QOknoRTKD96W1bkCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAeeAoG3xpVfAcA2ZN
39+
aJA0uEB7ZH5BjhFsvmc1kEZylkEo6STVs1uTTvc9+v3PqzYANycbHy/3N0EUo5OX
40+
X6tfo3SMn3c8MyZu/3960Vcs1YJApdC1P3FvHj25IQGz8qLgsmION1tijg0ySPQb
41+
CYFXZ8T0ZYHA2X2QMieYiB9cNcmaL3Mlx04nf2Vfb+e/6kCWKkETlfSDIde9/J2M
42+
kVAYLGWWnwWvfRvjEaZ7SZNWslBttUTEr4PiFkvdPU01UF3VAjkcAOcDzvueGdmT
43+
d5Eg1BEWWmNBdT+Yg5hoy5Hx8R7H9ZcyoXnIMKCa9pOoIBIEk/hmcXj3smmjAMfO
44+
wTO08w==
45+
-----END CERTIFICATE-----
46+
-----BEGIN CERTIFICATE-----
47+
MIICsTCCAZmgAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwEjEQMA4GA1UEAwwHUm9v
48+
dC1jYTAeFw0yMDExMjUxMjEyMDRaFw0yMTExMjUxMjEyMDRaMBMxETAPBgNVBAMM
49+
CEludGVybTEuMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0/VPbQ2O
50+
YERPdfjLsTn/eGu4R98iNOw3pwyOtxK5b7w/b3sheGvoA7iRdyk6TBQ6e6sGUnUj
51+
fImyxNnWHRNBsX6NwwYk3DvFMvVgIfYi657m+7JaPYT+TcsLF223n2mDP3PHQe4B
52+
etOdP81gC2c+l1cmPSduMwzi3Ze64gQ15PvyTjVcTRuVCFZIpdAZ2DLEFMviuc7O
53+
vnxA+DFfN5Ve5gCJIEmxEtkHtolqZbhBIVPsfz5CofjD9bPm452ibssNoZgKU030
54+
9h2QPzvOhJ4iN2UDto2/Mq6xemEXxhVV7GyJ5iKtlnz1TYNAVPKkzhY+J9fnG/yT
55+
/MOwREaq+/9AbwIDAQABoxAwDjAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBCwUA
56+
A4IBAQCyqfVs2oawxgymfI/Nk6aGG+EjG+aBixu9tO45hQT2mEyb5ztP49ZwFOpc
57+
+ys1snq3gtol2r7J+Up96DJ3aF6U3OE3iDqbtfjosMmi+rQQDRK/hp6QcU5rQucY
58+
hDiooiuajp7bhUgEdjhDW7GbV9yT1bA9WL5urFoGE0THUKLoMV4GCRQAQsodEx+B
59+
yos50UBCHuSkeJWRGmR4lpyIprPJaQgC7E83FfLe5UDsP1bioDiW4RZk4sqryy/z
60+
VJQNGgXYnlftf6J6WOPLdzU51R21yGCRjmNP0G9Vay9Wq7WOdDqjiQjWZyXWFf6H
61+
bbp7qAgS2JLTieLZ3GXBg0RTi+lK
62+
-----END CERTIFICATE-----
63+
-----BEGIN CERTIFICATE-----
64+
MIICsjCCAZqgAwIBAgICEAEwDQYJKoZIhvcNAQELBQAwEzERMA8GA1UEAwwISW50
65+
ZXJtMS4wHhcNMjAxMTI1MTIxMjA0WhcNMjExMTI1MTIxMjA0WjATMREwDwYDVQQD
66+
DAhJbnRlcm0yLjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKto0lJW
67+
e+0+6u/gxG3NNfoqHWAMiDm+Ogcv1aIUTxTK8CO6dlwLTAMDg47wXgZSE+fpwtJf
68+
OCV9uwUvoVrdBazPil13KTQKHkN3jV6TnrU92gJpb1uBCQwQQXvCaQeUrMNPC7h3
69+
lYaxAODH62B5Pl2PY/DXdaKNbsN0chOZmNl87FgtXH4/ITOqqHY/vLW4ikYbADHi
70+
HLZOXFFV6VK6tNm5NgbKpDeUG5I5mjilZSfxnHHJAFIrIy19wK+wyPr9X+Eyph7Z
71+
slYDDZ/+RRIEp3tNlaac+g+uv1CJZWdRcTb+q/fAMd/emL0ofg3XKRNtSwfDuDNh
72+
z7i68VKL/6Xtd3cCAwEAAaMQMA4wDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsF
73+
AAOCAQEAYUwKKDKMG0ZwUJwJuqXZfCrf+95t9aeb+ALcFw7gABrdSFY9VmDQj2wW
74+
wl1afkV0jAREEnOtHJ0wioAhD86TUMoj99+UMEtp/r9QPH1XMClnCS0kp1M9ogCu
75+
PlqFamJlKhIa3xvvKSamU6G7qlbVzi2y7x/SBhK/U/FDo4bElgwG6WVXsluOQ6fT
76+
uUAJTqNfWcSdw2ntIGbwlbg1sco3a2JENB/5tyTSIWlwwUo6d+s2W3ZcNePWAPdr
77+
gEAVV1yOWsb1OVse2NRye5lH3cc+x0O1XYzWiC6G3GWYUmoPhl50fsidrd6WQIt5
78+
+6MXQJQW+CgBnPiCdSfN58mxv49xJQ==
79+
-----END CERTIFICATE-----

‎e2e/tests/storage_ssl_certificates/haproxy.cfg‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
# _version=42
2+
3+
global
4+
log 127.0.0.1 local2
5+
chroot /var/lib/haproxy
6+
pidfile /var/run/haproxy.pid
7+
maxconn 4000
8+
user haproxy
9+
group haproxy
10+
stats socket /var/lib/haproxy/stats level admin
11+
12+
defaults
13+
mode http
14+
log global
15+
option httplog
16+
option dontlognull
17+
option http-server-close
18+
option forwardfor except 127.0.0.0/8
19+
option redispatch
20+
retries 3
21+
timeout http-request 10s
22+
timeout queue 1m
23+
timeout connect 10s
24+
timeout client 1m
25+
timeout server 1m
26+
timeout http-keep-alive 10s
27+
timeout check 10s
28+
maxconn 3000
29+
30+
frontend test_storage_ssl_certificates
31+
# bind *:1337 crt /etc/haproxy/ssl/4.pem
32+
bind *:1337 crt /etc/haproxy/ssl/3.pem
33+
default_backend test_storage_ssl_certificates
34+
35+
backend test_storage_ssl_certificates
36+
server appx 127.0.0.1:8080 check disabled
37+

‎e2e/tests/storage_ssl_certificates/test.bats‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
#!/usr/bin/env bats
22
#
3-
# Copyright 2019 HAProxy Technologies
3+
# Copyright 2021 HAProxy Technologies
44
#
55
# Licensed under the Apache License, Version 2.0 (the "License");
66
# you may not use this file except in compliance with the License.

‎e2e/tests/storage_ssl_certificates/test_with_conf.bats‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
#!/usr/bin/env bats
2+
#
3+
# Copyright 2021 HAProxy Technologies
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http:#www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
#
17+
18+
load '../../libs/dataplaneapi'
19+
load "../../libs/get_json_path"
20+
load '../../libs/version'
21+
load '../../libs/haproxy_config_setup'
22+
23+
@test "Refuse to delete still used ssl certificate file" {
24+
run docker cp "${BATS_TEST_DIRNAME}/3.pem" "${DOCKER_CONTAINER_NAME}:/etc/haproxy/ssl/"
25+
assert_success
26+
27+
run dpa_curl DELETE "/services/haproxy/storage/ssl_certificates/3.pem"
28+
assert_success
29+
30+
dpa_curl_status_body_safe '$output'
31+
echo -e "$output"
32+
assert_equal $SC 409
33+
34+
assert dpa_docker_exec 'ls /etc/haproxy/ssl/3.pem'
35+
36+
# clean up this test
37+
assert dpa_docker_exec 'rm /etc/haproxy/ssl/3.pem'
38+
}
39+
40+
@test "Allow to delete ssl certificate file referenced in comments" {
41+
run docker cp "${BATS_TEST_DIRNAME}/4.pem" "${DOCKER_CONTAINER_NAME}:/etc/haproxy/ssl/"
42+
assert_success
43+
44+
run dpa_curl DELETE "/services/haproxy/storage/ssl_certificates/4.pem"
45+
assert_success
46+
47+
dpa_curl_status_body_safe '$output'
48+
echo -e "$output"
49+
assert_equal $SC 204
50+
51+
refute dpa_docker_exec 'ls /etc/haproxy/ssl/4.pem'
52+
53+
# clean up this test
54+
run dpa_docker_exec 'rm /etc/haproxy/ssl/4.pem'
55+
}

‎handlers/ssl_cert_storage.go‎

Lines changed: 28 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,10 @@
1616
package handlers
1717

1818
import (
19+
"bufio"
20+
"fmt"
1921
"path/filepath"
22+
"strings"
2023

2124
"github.com/go-openapi/runtime"
2225
"github.com/go-openapi/runtime/middleware"
@@ -79,7 +82,31 @@ type StorageDeleteStorageSSLCertificateHandlerImpl struct {
7982
}
8083

8184
func (h *StorageDeleteStorageSSLCertificateHandlerImpl) Handle(params storage.DeleteStorageSSLCertificateParams, principal interface{}) middleware.Responder {
82-
err := h.Client.SSLCertStorage.Delete(params.Name)
85+
runningConf := strings.NewReader(h.Client.Configuration.Parser.String())
86+
87+
filename, err := h.Client.SSLCertStorage.Get(params.Name)
88+
if err != nil {
89+
e := misc.HandleError(err)
90+
return storage.NewDeleteStorageSSLCertificateDefault(int(*e.Code)).WithPayload(e)
91+
}
92+
93+
// this is far from perfect but should provide a basic level of protection
94+
scanner := bufio.NewScanner(runningConf)
95+
96+
lineNr := 0
97+
98+
for scanner.Scan() {
99+
line := strings.TrimSpace(scanner.Text())
100+
if strings.Contains(line, filename) && !strings.HasPrefix(line, "#") {
101+
errCode := misc.ErrHTTPConflict
102+
errMsg := fmt.Sprintf("rejecting attempt to delete file %s referenced in haproxy conf at line %d: %s", filename, lineNr-1, line)
103+
e := &models.Error{Code: &errCode, Message: &errMsg}
104+
return storage.NewDeleteStorageSSLCertificateDefault(int(*e.Code)).WithPayload(e)
105+
}
106+
lineNr++
107+
}
108+
109+
err = h.Client.SSLCertStorage.Delete(params.Name)
83110
if err != nil {
84111
e := misc.HandleError(err)
85112
return storage.NewDeleteStorageSSLCertificateDefault(int(*e.Code)).WithPayload(e)

0 commit comments

Comments
 (0)