MEDIUM: ssl: Start update task if at least one ocsp-update option is set to on

This patch effectively enables the ocsp auto update mechanism. If a
least one ocsp-update option is enabled in a crt-list, then the ocsp
auto update task is created. It will look into the dedicated ocsp update
tree for the next update to be updated, use the http_client to send the
ocsp request to the proper responder, validate the received ocsp
response and update the ocsp response tree before finally reinserting
the entry in the ocsp update tree (with a next update time set to
now+1H).
The main task will then sleep until another entry needs to be updated.

The task gets scheduled after config check in order to avoid trying to
update ocsp responses while configuration is still being parsed (and
certificates and actual ocsp responses are loaded).

diff --git a/src/cfgparse-ssl.c b/src/cfgparse-ssl.c
index ed9765c24159e0d581cc77e54ea7e0b1a16f189a..f4a5214605df7bf76bc693e6144f8ac95abb746e 100644 (file)
--- a/src/cfgparse-ssl.c
+++ b/src/cfgparse-ssl.c
@@ -1354,6 +1354,13 @@ static int ssl_bind_parse_ocsp_update(char **args, int cur_arg, struct proxy *px
                return ERR_ALERT | ERR_FATAL;
        }
 
+       if (ssl_conf->ocsp_update == SSL_SOCK_OCSP_UPDATE_ON) {
+               /* We might need to create the main ocsp update task */
+               int ret = ssl_create_ocsp_update_task(err);
+               if (ret)
+                       return ret;
+       }
+
        return 0;
 }
 

diff --git a/src/ssl_sock.c b/src/ssl_sock.c
index 7df70489093e7a8ce4fdac2eec8f3f594c0babfa..79efc8eeea8bf4581d112092dffa8da95a83cfa1 100644 (file)
--- a/src/ssl_sock.c
+++ b/src/ssl_sock.c
@@ -1363,6 +1363,15 @@ int ssl_create_ocsp_update_task(char **err)
        return 0;
 }
 
+static int ssl_ocsp_task_schedule()
+{
+       if (ocsp_update_task)
+               task_schedule(ocsp_update_task, now_ms);
+
+       return 0;
+}
+REGISTER_POST_CHECK(ssl_ocsp_task_schedule);
+
 static void ssl_sock_free_ocsp(struct certificate_ocsp *ocsp);
 
 static void ssl_destroy_ocsp_update_task(void)