mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2025-08-06 23:27:04 +02:00
Code Issues Projects Releases Wiki Activity

MINOR: ssl: Add sample fetches related to OCSP update

Browse Source 
This patch adds a series of sample fetches that rely on the specified
OCSP update context structure. They will then be of use only in the
context of an ongoing OCSP update.
They cannot be used directly in the configuration so they won't be made
public. They will be used in the OCSP update's specific log format which
should be emitted by the update task itself in a future patch.
This commit is contained in:
Remi Tricot-Le Breton 2023-02-28 17:46:24 +01:00 committed by William Lallemand
parent d14fc51613
commit d42c896216
1 changed files with 93 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

93
src/ssl_ocsp.c
View File

@ -1879,6 +1879,79 @@ static void cli_release_show_ocsp_updates(struct appctx *appctx)
}
static int
smp_fetch_ssl_ocsp_certid(const struct arg *args, struct sample *smp, const char *kw, void *private)
{
struct buffer *data = get_trash_chunk();
struct certificate_ocsp *ocsp = ssl_ocsp_task_ctx.cur_ocsp;
if (!ocsp)
return 0;
dump_binary(data, (char *)ocsp->key_data, ocsp->key_length);
smp->data.type = SMP_T_STR;
smp->data.u.str = *data;
return 1;
}
static int
smp_fetch_ssl_ocsp_status(const struct arg *args, struct sample *smp, const char *kw, void *private)
{
struct certificate_ocsp *ocsp = ssl_ocsp_task_ctx.cur_ocsp;
if (!ocsp)
return 0;
smp->data.type = SMP_T_SINT;
smp->data.u.sint = ssl_ocsp_task_ctx.update_status;
return 1;
}
static int
smp_fetch_ssl_ocsp_status_str(const struct arg *args, struct sample *smp, const char *kw, void *private)
{
struct certificate_ocsp *ocsp = ssl_ocsp_task_ctx.cur_ocsp;
if (!ocsp)
return 0;
if (ssl_ocsp_task_ctx.update_status >= OCSP_UPDT_ERR_LAST)
return 0;
smp->data.type = SMP_T_STR;
smp->data.u.str = ist2buf(ocsp_update_errors[ssl_ocsp_task_ctx.update_status]);
return 1;
}
static int
smp_fetch_ssl_ocsp_fail_cnt(const struct arg *args, struct sample *smp, const char *kw, void *private)
{
struct certificate_ocsp *ocsp = ssl_ocsp_task_ctx.cur_ocsp;
if (!ocsp)
return 0;
smp->data.type = SMP_T_SINT;
smp->data.u.sint = ocsp->num_failure;
return 1;
}
static int
smp_fetch_ssl_ocsp_success_cnt(const struct arg *args, struct sample *smp, const char *kw, void *private)
{
struct certificate_ocsp *ocsp = ssl_ocsp_task_ctx.cur_ocsp;
if (!ocsp)
return 0;
smp->data.type = SMP_T_SINT;
smp->data.u.sint = ocsp->num_success;
return 1;
}
static struct cli_kw_list cli_kws = {{ },{
{ { "set", "ssl", "ocsp-response", NULL }, "set ssl ocsp-response <resp|payload> : update a certificate's OCSP Response from a base64-encode DER", cli_parse_set_ocspresponse, NULL },
@ -1892,6 +1965,26 @@ static struct cli_kw_list cli_kws = {{ },{
INITCALL1(STG_REGISTER, cli_register_kw, &cli_kws);
/* Note: must not be declared <const> as its list will be overwritten.
* Please take care of keeping this list alphabetically sorted.
*
* Those fetches only have a valid value during an OCSP update process so they
* can only be used in a log format of a log line built by the update process
* task itself.
*/
static struct sample_fetch_kw_list sample_fetch_keywords = {ILH, {
{ "ssl_ocsp_certid", smp_fetch_ssl_ocsp_certid, 0, NULL, SMP_T_STR, SMP_USE_L5SRV },
{ "ssl_ocsp_status", smp_fetch_ssl_ocsp_status, 0, NULL, SMP_T_SINT, SMP_USE_L5SRV },
{ "ssl_ocsp_status_str", smp_fetch_ssl_ocsp_status_str, 0, NULL, SMP_T_STR, SMP_USE_L5SRV },
{ "ssl_ocsp_fail_cnt", smp_fetch_ssl_ocsp_fail_cnt, 0, NULL, SMP_T_SINT, SMP_USE_L5SRV },
{ "ssl_ocsp_success_cnt", smp_fetch_ssl_ocsp_success_cnt, 0, NULL, SMP_T_SINT, SMP_USE_L5SRV },
{ NULL, NULL, 0, 0, 0 },
}};
INITCALL1(STG_REGISTER, sample_register_fetches, &sample_fetch_keywords);
/*
* Local variables:
* c-indent-level: 8