MINOR: ssl: Store 'ocsp-update' mode in the ckch_data and check for inconsistencies

The 'ocsp-update' option is parsed at the same time as all the other
bind line options but it does not actually have anything to do with the
bind line since it concerns the frontend certificate instead. For that
reason, we should have a mean to identify inconsistencies in the
configuration and raise an error when a given certificate has two
different ocsp-update modes specified in one or more crt-lists.
The simplest way to do it is to store the ocsp update mode directly in
the ckch and not only in the ssl_bind_conf.

diff --git a/include/haproxy/ssl_ckch-t.h b/include/haproxy/ssl_ckch-t.h
index eba0b1a368ab88c8598833d584132d5e28459533..b6cd6935d6e9171ae05b71181059bc5fd5c00915 100644 (file)
--- a/include/haproxy/ssl_ckch-t.h
+++ b/include/haproxy/ssl_ckch-t.h
@@ -55,6 +55,7 @@ struct ckch_data {
        struct buffer *ocsp_response;
        X509 *ocsp_issuer;
        OCSP_CERTID *ocsp_cid;
+       int ocsp_update_mode;
 };
 
 /*

diff --git a/src/ssl_crtlist.c b/src/ssl_crtlist.c
index c532c01f60dd3b68c9f156c41d0be5e756e77bb7..c1b27f494031c8a3617eec0d64a719018932cd90 100644 (file)
--- a/src/ssl_crtlist.c
+++ b/src/ssl_crtlist.c
@@ -563,6 +563,8 @@ int crtlist_parse_file(char *file, struct bind_conf *bind_conf, struct proxy *cu
 
                                entry->node.key = ckchs;
                                entry->crtlist = newlist;
+                               if (entry->ssl_conf)
+                                       ckchs->data->ocsp_update_mode = entry->ssl_conf->ocsp_update;
                                ebpt_insert(&newlist->entries, &entry->node);
                                LIST_APPEND(&newlist->ord_entries, &entry->by_crtlist);
                                LIST_APPEND(&ckchs->crtlist_entry, &entry->by_ckch_store);
@@ -611,6 +613,14 @@ int crtlist_parse_file(char *file, struct bind_conf *bind_conf, struct proxy *cu
 
                                        entry_dup->node.key = ckchs;
                                        entry_dup->crtlist = newlist;
+                                       if (entry->ssl_conf) {
+                                               if (ckchs->data->ocsp_update_mode != SSL_SOCK_OCSP_UPDATE_DFLT &&
+                                                   ckchs->data->ocsp_update_mode != entry->ssl_conf->ocsp_update) {
+                                                       memprintf(err, "%sIncompatibilities found in OCSP update mode for certificate %s\n", err && *err ? *err : "", crt_path);
+                                                       cfgerr |= ERR_ALERT;
+                                               }
+                                               ckchs->data->ocsp_update_mode = entry->ssl_conf->ocsp_update;
+                                       }
                                        ebpt_insert(&newlist->entries, &entry_dup->node);
                                        LIST_APPEND(&newlist->ord_entries, &entry_dup->by_crtlist);
                                        LIST_APPEND(&ckchs->crtlist_entry, &entry_dup->by_ckch_store);
@@ -634,6 +644,14 @@ int crtlist_parse_file(char *file, struct bind_conf *bind_conf, struct proxy *cu
                } else {
                        entry->node.key = ckchs;
                        entry->crtlist = newlist;
+                       if (entry->ssl_conf) {
+                               if (ckchs->data->ocsp_update_mode != SSL_SOCK_OCSP_UPDATE_DFLT &&
+                                   ckchs->data->ocsp_update_mode != entry->ssl_conf->ocsp_update) {
+                                       memprintf(err, "%sIncompatibilities found in OCSP update mode for certificate %s\n", err && *err ? *err : "", crt_path);
+                                       cfgerr |= ERR_ALERT;
+                               }
+                               ckchs->data->ocsp_update_mode = entry->ssl_conf->ocsp_update;
+                       }
                        ebpt_insert(&newlist->entries, &entry->node);
                        LIST_APPEND(&newlist->ord_entries, &entry->by_crtlist);
                        LIST_APPEND(&ckchs->crtlist_entry, &entry->by_ckch_store);