On the trunk:

mod_md: When the last domain name from an MD is moved to another one,
     that now empty MD gets moved to the store archive. PR 62572.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1837357 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/CHANGES b/CHANGES
index 1e26ed7786ff201127a422a02987e2d33df30c3c..194ec4a8987cb14f5051d790202e87256c101cbe 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,6 +1,9 @@
                                                          -*- coding: utf-8 -*-
 Changes with Apache 2.5.1
 
+  *) mod_md: When the last domain name from an MD is moved to another one,
+     that now empty MD gets moved to the store archive. PR 62572. [Stefan Eissing]
+
   *) mod_proxy: If ProxyPassReverse is used for reverse mapping of relative
      redirects, subsequent ProxyPassReverse statements, whether they are
      relative or absolute, may fail.  PR 60408.  [Peter Haworth <pmh1wheel gmail.com>]

diff --git a/modules/md/md_reg.c b/modules/md/md_reg.c
index c269e0a9acee48dc9f593fb6e6dbc6c9f2336083..233fea79d726b228457f2a55245a31ec10565d94 100644 (file)
--- a/modules/md/md_reg.c
+++ b/modules/md/md_reg.c
@@ -579,7 +579,7 @@ static apr_status_t creds_load(void *baton, apr_pool_t *p, apr_pool_t *ptemp, va
     md_reg_t *reg = baton;
     md_pkey_t *privkey;
     apr_array_header_t *pubcert;
-    md_creds_t *creds = NULL, **pcreds;
+    md_creds_t *creds, **pcreds;
     const md_t *md;
     md_cert_state_t cert_state;
     md_store_group_t group;
@@ -635,11 +635,10 @@ apr_status_t md_reg_creds_get(const md_creds_t **pcreds, md_reg_t *reg,
 
 typedef struct {
     apr_pool_t *p;
-    apr_array_header_t *conf_mds;
     apr_array_header_t *store_mds;
 } sync_ctx;
 
-static int find_changes(void *baton, md_store_t *store, md_t *md, apr_pool_t *ptemp)
+static int do_add_md(void *baton, md_store_t *store, md_t *md, apr_pool_t *ptemp)
 {
     sync_ctx *ctx = baton;
 
@@ -649,6 +648,18 @@ static int find_changes(void *baton, md_store_t *store, md_t *md, apr_pool_t *pt
     return 1;
 }
 
+static apr_status_t read_store_mds(md_reg_t *reg, sync_ctx *ctx)
+{
+    int rv;
+    
+    apr_array_clear(ctx->store_mds);
+    rv = md_store_md_iter(do_add_md, ctx, reg->store, ctx->p, MD_SG_DOMAINS, "*");
+    if (APR_STATUS_IS_ENOENT(rv)) {
+        rv = APR_SUCCESS;
+    }
+    return rv;
+}
+
 apr_status_t md_reg_set_props(md_reg_t *reg, apr_pool_t *p, int can_http, int can_https)
 {
     if (reg->can_http != can_http || reg->can_https != can_https) {
@@ -686,17 +697,11 @@ apr_status_t md_reg_sync(md_reg_t *reg, apr_pool_t *p, apr_pool_t *ptemp,
                          apr_array_header_t *master_mds) 
 {
     sync_ctx ctx;
-    md_store_t *store = reg->store;
     apr_status_t rv;
 
     ctx.p = ptemp;
-    ctx.conf_mds = master_mds;
-    ctx.store_mds = apr_array_make(ptemp, 100, sizeof(md_t *));
-    
-    rv = md_store_md_iter(find_changes, &ctx, store, ptemp, MD_SG_DOMAINS, "*");
-    if (APR_STATUS_IS_ENOENT(rv)) {
-        rv = APR_SUCCESS;
-    }
+    ctx.store_mds = apr_array_make(ptemp,100, sizeof(md_t *));
+    rv = read_store_mds(reg, &ctx);
     
     md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, p, 
                   "sync: found %d mds in store", ctx.store_mds->nelts);
@@ -705,8 +710,8 @@ apr_status_t md_reg_sync(md_reg_t *reg, apr_pool_t *p, apr_pool_t *ptemp,
         md_t *md, *config_md, *smd, *omd;
         const char *common;
         
-        for (i = 0; i < ctx.conf_mds->nelts; ++i) {
-            md = APR_ARRAY_IDX(ctx.conf_mds, i, md_t *);
+        for (i = 0; i < master_mds->nelts; ++i) {
+            md = APR_ARRAY_IDX(master_mds, i, md_t *);
             
             /* find the store md that is closest match for the configured md */
             smd = md_find_closest_match(ctx.store_mds, md);
@@ -734,7 +739,7 @@ apr_status_t md_reg_sync(md_reg_t *reg, apr_pool_t *p, apr_pool_t *ptemp,
                     assert(common);
                     
                     /* Is this md still configured or has it been abandoned in the config? */
-                    config_md = md_get_by_name(ctx.conf_mds, omd->name);
+                    config_md = md_get_by_name(master_mds, omd->name);
                     if (config_md && md_contains(config_md, common, 0)) {
                         /* domain used in two configured mds, not allowed */
                         rv = APR_EINVAL;
@@ -742,21 +747,19 @@ apr_status_t md_reg_sync(md_reg_t *reg, apr_pool_t *p, apr_pool_t *ptemp,
                                       "domain %s used in md %s and %s", 
                                       common, md->name, omd->name);
                     }
-                    else if (config_md) {
-                        /* domain stored in omd, but no longer has the offending domain,
-                           remove it from the store md. */
-                        omd->domains = md_array_str_remove(ptemp, omd->domains, common, 0);
-                        rv = md_reg_update(reg, ptemp, omd->name, omd, MD_UPD_DOMAINS);
-                    }
                     else {
-                        /* domain in a store md that is no longer configured, warn about it.
-                         * Remove the domain here, so we can progress, but never save it. */
+                        /* remove it from the other md and update store, or, if it
+                         * is now empty, move it into the archive */
                         omd->domains = md_array_str_remove(ptemp, omd->domains, common, 0);
-                        md_log_perror(MD_LOG_MARK, MD_LOG_WARNING, rv, p, 
-                                      "domain %s, configured in md %s, is part of the stored md %s."
-                                      " That md however is no longer mentioned in the config. "
-                                      "If you longer want it, remove the md from the store.", 
-                                      common, md->name, omd->name);
+                        if (apr_is_empty_array(omd->domains)) {
+                            md_log_perror(MD_LOG_MARK, MD_LOG_WARNING, rv, p, 
+                                          "All domains of the MD %s have moved elsewhere, "
+                                          " moving it to the archive. ", omd->name);
+                            md_reg_remove(reg, ptemp, omd->name, 1); /* best effort */
+                        }
+                        else {
+                            rv = md_reg_update(reg, ptemp, omd->name, omd, MD_UPD_DOMAINS);
+                        }
                     }
                 }
 
@@ -841,6 +844,11 @@ apr_status_t md_reg_sync(md_reg_t *reg, apr_pool_t *p, apr_pool_t *ptemp,
     return rv;
 }
 
+apr_status_t md_reg_remove(md_reg_t *reg, apr_pool_t *p, const char *name, int archive)
+{
+    return md_store_move(reg->store, p, MD_SG_DOMAINS, MD_SG_ARCHIVE, name, archive);
+}
+
 
 /**************************************************************************************************/
 /* driving */

diff --git a/modules/md/md_reg.h b/modules/md/md_reg.h
index 2bf738583c0e2a5265ec2f51ead4bef0f6b3f64a..d976b7fe8038a9a9b092f6848be9bf1fe4d736eb 100644 (file)
--- a/modules/md/md_reg.h
+++ b/modules/md/md_reg.h
@@ -124,6 +124,8 @@ apr_status_t md_reg_get_cred_files(md_reg_t *reg, const md_t *md, apr_pool_t *p,
 apr_status_t md_reg_sync(md_reg_t *reg, apr_pool_t *p, apr_pool_t *ptemp, 
                          apr_array_header_t *master_mds);
 
+apr_status_t md_reg_remove(md_reg_t *reg, apr_pool_t *p, const char *name, int archive);
+
 /**************************************************************************************************/
 /* protocol drivers */
 

diff --git a/modules/md/md_version.h b/modules/md/md_version.h
index b87f19c1dbb7249380e431540736eb8ed5a2f639..34ab4eb61e669007cc5c5ca142ceda56208fe04d 100644 (file)
--- a/modules/md/md_version.h
+++ b/modules/md/md_version.h
@@ -27,7 +27,7 @@
  * @macro
  * Version number of the md module as c string
  */
-#define MOD_MD_VERSION "1.1.15"
+#define MOD_MD_VERSION "1.1.16"
 
 /**
  * @macro
@@ -35,7 +35,7 @@
  * release. This is a 24 bit number with 8 bits for major number, 8 bits
  * for minor and 8 bits for patch. Version 1.2.3 becomes 0x010203.
  */
-#define MOD_MD_VERSION_NUM 0x01010f
+#define MOD_MD_VERSION_NUM 0x010110
 
 #define MD_ACME_DEF_URL    "https://acme-v01.api.letsencrypt.org/directory"