[Release-7.3] TLS should accept same key with different values (#11763)

* fix tls

* address comment

Author: kakaiu

flow/TLSConfig.actor.cpp

@@ -601,7 +601,7 @@ TLSPolicy::Rule::Rule(std::string input) {
 
 			s = eq + 3;
 		} else {
-			std::map<int, Criteria>* criteria = &subject_criteria;
+			std::set<std::pair<NID, Criteria>>* criteria = &subject_criteria;
 
 			if (term.find('.') != term.npos) {
 				auto scoped = splitPair(term, '.');
@@ -626,7 +626,15 @@ TLSPolicy::Rule::Rule(std::string input) {
 
 			NID termNID = abbrevToNID(term);
 			const X509Location loc = locationForNID(termNID);
-			criteria->insert(std::make_pair(termNID, Criteria(unesc, mt, loc)));
+			auto criteriaToInsert = Criteria(unesc, mt, loc);
+			auto res = criteria->insert(std::make_pair(termNID, criteriaToInsert));
+			if (!res.second) {
+				TraceEvent(SevWarn, "TLSKeyValueDuplicated")
+				    .suppressFor(60.0)
+				    .detail("TermNID", termNID)
+				    .detail("NewCriteria", criteriaToInsert.criteria)
+				    .detail("ExistingCriteria", res.first->second.criteria);
+			}
 
 			if (remain != input.size() && input[remain] != ',')
 				throw std::runtime_error("parse_verify");

flow/include/flow/TLSConfig.actor.h

@@ -42,7 +42,6 @@
 #include "flow/FastRef.h"
 #include "flow/Knobs.h"
 #include "flow/flow.h"
-
 #include "flow/actorcompiler.h" // This must be the last #include.
 
 typedef int NID;
@@ -75,6 +74,17 @@ struct Criteria {
 	}
 
 	bool operator!=(const Criteria& c) const noexcept { return !(*this == c); }
+
+	bool operator<(const Criteria& c) const {
+		if (criteria != c.criteria) {
+			return criteria < c.criteria;
+		} else if (match_type != c.match_type) {
+			return match_type < c.match_type;
+		} else if (location != c.location) {
+			return location < c.location;
+		}
+		return false;
+	}
 };
 
 enum class TLSEndpointType { UNSET = 0, CLIENT, SERVER };
@@ -253,9 +263,15 @@ class TLSPolicy : ReferenceCounted<TLSPolicy> {
 
 		std::string toString() const;
 
+<<<<<<< HEAD
 		CriteriaMap subject_criteria;
 		CriteriaMap issuer_criteria;
 		CriteriaMap root_criteria;
+=======
+		std::set<std::pair<NID, Criteria>> subject_criteria; // deduped and sorted
+		std::set<std::pair<NID, Criteria>> issuer_criteria;
+		std::set<std::pair<NID, Criteria>> root_criteria;
+>>>>>>> 770ffb741 ([Release-7.3] TLS should accept same key with different values (#11763))
 
 		bool verify_cert = true;
 		bool verify_time = true;