[Feature] Auto-detect SSL from bind sockets, remove ssl = true option

Instead of requiring a separate `ssl = true` worker option, automatically
detect SSL need by checking if any bind socket has the ssl flag. Emit an
error if SSL bind sockets are configured but ssl_cert/ssl_key are missing.

diff --git a/src/controller.c b/src/controller.c
index 73a83d1f366e362e21479aa78a08a961a778a61b..a74e783aaecc2a2df5bd1a827d3608038188769d 100644 (file)
--- a/src/controller.c
+++ b/src/controller.c
@@ -140,8 +140,6 @@ struct rspamd_controller_worker_ctx {
        struct rspamd_config *cfg;
        /* END OF COMMON PART */
        ev_tstamp timeout;
-       /* Whether we use ssl for this server */
-       gboolean use_ssl;
        /* Webui password */
        char *password;
        /* Privileged password */
@@ -3721,15 +3719,6 @@ init_controller_worker(struct rspamd_config *cfg)
                                                                          0,
                                                                          "Password for read and write commands");
 
-       rspamd_rcl_register_worker_option(cfg,
-                                                                         type,
-                                                                         "ssl",
-                                                                         rspamd_rcl_parse_struct_boolean,
-                                                                         ctx,
-                                                                         G_STRUCT_OFFSET(struct rspamd_controller_worker_ctx, use_ssl),
-                                                                         0,
-                                                                         "Enable SSL for this worker");
-
        rspamd_rcl_register_worker_option(cfg,
                                                                          type,
                                                                          "ssl_cert",
@@ -4119,16 +4108,21 @@ start_controller_worker(struct rspamd_worker *worker)
                                                                           rspamd_controller_finish_handler, ctx->timeout,
                                                                           ctx->static_files_dir, ctx->http_ctx);
 
-       if (ctx->use_ssl && ctx->ssl_cert && ctx->ssl_key) {
-               gpointer server_ssl_ctx = rspamd_init_ssl_ctx_server(ctx->ssl_cert, ctx->ssl_key);
+       if (rspamd_worker_has_ssl_socket(worker)) {
+               if (ctx->ssl_cert && ctx->ssl_key) {
+                       gpointer server_ssl_ctx = rspamd_init_ssl_ctx_server(ctx->ssl_cert, ctx->ssl_key);
 
-               if (server_ssl_ctx) {
-                       rspamd_ssl_ctx_config(ctx->cfg, server_ssl_ctx);
-                       rspamd_http_router_set_ssl(ctx->http, server_ssl_ctx);
-                       msg_info_ctx("enabled SSL for controller worker");
+                       if (server_ssl_ctx) {
+                               rspamd_ssl_ctx_config(ctx->cfg, server_ssl_ctx);
+                               rspamd_http_router_set_ssl(ctx->http, server_ssl_ctx);
+                               msg_info_ctx("enabled SSL for controller worker");
+                       }
+                       else {
+                               msg_err_ctx("failed to create SSL context for controller worker");
+                       }
                }
                else {
-                       msg_err_ctx("failed to create SSL context for controller worker");
+                       msg_err_ctx("ssl bind socket configured but ssl_cert or ssl_key is missing");
                }
        }
 

diff --git a/src/libserver/worker_util.c b/src/libserver/worker_util.c
index c28ce366611d479886ac89cc761ebacfa9003efe..35700fb325aae88b0c4755f31e8b503d2c981b20 100644 (file)
--- a/src/libserver/worker_util.c
+++ b/src/libserver/worker_util.c
@@ -2914,3 +2914,22 @@ rspamd_worker_is_ssl_socket(struct rspamd_worker *worker, int fd)
 
        return FALSE;
 }
+
+gboolean
+rspamd_worker_has_ssl_socket(struct rspamd_worker *worker)
+{
+       struct rspamd_worker_bind_conf *bcf;
+
+       if (worker == NULL || worker->cf == NULL) {
+               return FALSE;
+       }
+
+       LL_FOREACH(worker->cf->bind_conf, bcf)
+       {
+               if (bcf->is_ssl) {
+                       return TRUE;
+               }
+       }
+
+       return FALSE;
+}

diff --git a/src/libserver/worker_util.h b/src/libserver/worker_util.h
index 1089c0a9cf1032ed1e41f7fa71659e2abdec21a0..359351807f347d8cb4e8eeacbc5fdad4ba417265 100644 (file)
--- a/src/libserver/worker_util.h
+++ b/src/libserver/worker_util.h
@@ -391,6 +391,13 @@ rspamd_fstring_t *rspamd_metrics_to_prometheus_string(const ucl_object_t *top);
  */
 gboolean rspamd_worker_is_ssl_socket(struct rspamd_worker *worker, int fd);
 
+/**
+ * Check if any bind socket for this worker has SSL enabled
+ * @param worker
+ * @return TRUE if any socket is SSL
+ */
+gboolean rspamd_worker_has_ssl_socket(struct rspamd_worker *worker);
+
 #ifdef WITH_HYPERSCAN
 struct rspamd_control_command;
 

diff --git a/src/rspamd_proxy.c b/src/rspamd_proxy.c
index 0f61124334dd26884dc29708884f830323977725..abf482f6b1504415960fd3948e95c0dc986c2dac 100644 (file)
--- a/src/rspamd_proxy.c
+++ b/src/rspamd_proxy.c
@@ -181,8 +181,6 @@ struct rspamd_proxy_ctx {
        /* Default log tag type for worker */
        enum rspamd_proxy_log_tag_type log_tag_type;
        struct rspamd_main *srv;
-       /* Whether we use ssl for this server */
-       gboolean use_ssl;
        /* SSL cert */
        char *ssl_cert;
        /* SSL private key */
@@ -1065,14 +1063,6 @@ init_rspamd_proxy(struct rspamd_config *cfg)
                                                                          G_STRUCT_OFFSET(struct rspamd_proxy_ctx, encrypted_only),
                                                                          0,
                                                                          "Allow only encrypted connections");
-       rspamd_rcl_register_worker_option(cfg,
-                                                                         type,
-                                                                         "ssl",
-                                                                         rspamd_rcl_parse_struct_boolean,
-                                                                         ctx,
-                                                                         G_STRUCT_OFFSET(struct rspamd_proxy_ctx, use_ssl),
-                                                                         0,
-                                                                         "Enable SSL for this worker");
        rspamd_rcl_register_worker_option(cfg,
                                                                          type,
                                                                          "ssl_cert",
@@ -3416,15 +3406,20 @@ start_rspamd_proxy(struct rspamd_worker *worker)
                                                                  (rspamd_mempool_destruct_t) rspamd_http_context_free,
                                                                  ctx->http_ctx);
 
-       if (ctx->use_ssl && ctx->ssl_cert && ctx->ssl_key) {
-               ctx->server_ssl_ctx = rspamd_init_ssl_ctx_server(ctx->ssl_cert, ctx->ssl_key);
+       if (rspamd_worker_has_ssl_socket(worker)) {
+               if (ctx->ssl_cert && ctx->ssl_key) {
+                       ctx->server_ssl_ctx = rspamd_init_ssl_ctx_server(ctx->ssl_cert, ctx->ssl_key);
 
-               if (ctx->server_ssl_ctx) {
-                       rspamd_ssl_ctx_config(ctx->cfg, ctx->server_ssl_ctx);
-                       msg_info("enabled SSL for proxy worker");
+                       if (ctx->server_ssl_ctx) {
+                               rspamd_ssl_ctx_config(ctx->cfg, ctx->server_ssl_ctx);
+                               msg_info("enabled SSL for proxy worker");
+                       }
+                       else {
+                               msg_err("failed to create SSL context for proxy worker");
+                       }
                }
                else {
-                       msg_err("failed to create SSL context for proxy worker");
+                       msg_err("ssl bind socket configured but ssl_cert or ssl_key is missing");
                }
        }
 

diff --git a/src/worker.c b/src/worker.c
index 6dc9dd9741394eeae245d0ab1fa675259eaa1133..3d7fd0ba51051765ce5e9d9d58e848b7e579e804 100644 (file)
--- a/src/worker.c
+++ b/src/worker.c
@@ -487,15 +487,6 @@ init_worker(struct rspamd_config *cfg)
                                                                          0,
                                                                          "Encryption keypair");
 
-       rspamd_rcl_register_worker_option(cfg,
-                                                                         type,
-                                                                         "ssl",
-                                                                         rspamd_rcl_parse_struct_boolean,
-                                                                         ctx,
-                                                                         G_STRUCT_OFFSET(struct rspamd_worker_ctx, use_ssl),
-                                                                         0,
-                                                                         "Enable SSL for this worker");
-
        rspamd_rcl_register_worker_option(cfg,
                                                                          type,
                                                                          "ssl_cert",
@@ -547,15 +538,20 @@ start_worker(struct rspamd_worker *worker)
                                                                  (rspamd_mempool_destruct_t) rspamd_http_context_free,
                                                                  ctx->http_ctx);
 
-       if (ctx->use_ssl && ctx->ssl_cert && ctx->ssl_key) {
-               ctx->server_ssl_ctx = rspamd_init_ssl_ctx_server(ctx->ssl_cert, ctx->ssl_key);
+       if (rspamd_worker_has_ssl_socket(worker)) {
+               if (ctx->ssl_cert && ctx->ssl_key) {
+                       ctx->server_ssl_ctx = rspamd_init_ssl_ctx_server(ctx->ssl_cert, ctx->ssl_key);
 
-               if (ctx->server_ssl_ctx) {
-                       rspamd_ssl_ctx_config(ctx->cfg, ctx->server_ssl_ctx);
-                       msg_info_ctx("enabled SSL for normal worker");
+                       if (ctx->server_ssl_ctx) {
+                               rspamd_ssl_ctx_config(ctx->cfg, ctx->server_ssl_ctx);
+                               msg_info_ctx("enabled SSL for normal worker");
+                       }
+                       else {
+                               msg_err_ctx("failed to create SSL context for normal worker");
+                       }
                }
                else {
-                       msg_err_ctx("failed to create SSL context for normal worker");
+                       msg_err_ctx("ssl bind socket configured but ssl_cert or ssl_key is missing");
                }
        }
 

diff --git a/src/worker_private.h b/src/worker_private.h
index 19f6cd7b319a7551d7bae90a17ce2fec1b7f5d9f..b71d3b7333060793396852d4c7ba11c77c1b7868 100644 (file)
--- a/src/worker_private.h
+++ b/src/worker_private.h
@@ -45,8 +45,6 @@ struct rspamd_worker_ctx {
        gboolean is_mime;
        /* Allow encrypted requests only using network */
        gboolean encrypted_only;
-       /* Whether we use ssl for this server */
-       gboolean use_ssl;
        /* Limit of tasks */
        uint32_t max_tasks;
        /* Maximum time for task processing */