RepoMirrors/haproxy
1
0
Fork 0
mirror of http://git.haproxy.org/git/haproxy.git/ synced 2025-04-25 04:18:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

MINOR: ssl: Change the ocsp update log-format

Browse Source 
The dedicated proxy used for OCSP auto update is renamed OCSP-UPDATE
which should be more explicit than the previous HC_OCSP name. The
reference to the underlying httpclient is simply kept in the
documentation.
The certid is removed from the log line since it is not really
comprehensible and is replaced by the path to the corresponding frontend
certificate.
This commit is contained in:
Remi Tricot-Le Breton 2023-03-13 15:56:31 +01:00 committed by William Lallemand
parent e5d02c3d46
commit c9bfe32b71
2 changed files with 44 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

38
doc/configuration.txt
View File

@ -14972,18 +14972,34 @@ ocsp-update [ off | on ]
configured by the "tune.ssl.ocsp-update.maxdelay" and
"tune.ssl.ocsp-update.mindelay" global options.
Whenever an OCSP response is updated by the auto update task, a dedicated log
line is emitted. It will follow a dedicated log-format that looks like the
following "%ci:%cp [%tr] %ft %[ssl_ocsp_certid] %[ssl_ocsp_status]
%{+Q}[ssl_ocsp_status_str] %[ssl_ocsp_fail_cnt] %[ssl_ocsp_success_cnt]". The
specified "ssl_ocsp" sample fetches are not "public" because they cannot have
valid values when fetched out of the OCSP auto update process. Here is an
example of such a log line (with the longer outputs truncated for
readability):
<134>Feb 13 16:20:21 haproxy[37352]: -:- [13/Feb/2023:16:20:20.311] <HC_OCSP> \
303B30090[...] 2 "HTTP error" 0 0
Whenever an OCSP response is updated by the auto update task or following a
call to the "update ssl ocsp-response" CLI command, a dedicated log line is
emitted. It follows a dedicated log-format that contains the following header
"%ci:%cp [%tr] %ft" and is followed by specific OCSP-related information:
- the path of the corresponding frontend certificate
- a numerical update status
- a textual update status
- the number of update failures for the given response
- the number of update successes for the givan response
See "show ssl ocsp-updates" CLI command for a full list of error codes and
error messages.
error messages. This line is emitted regardless of the success or failure of
the concerned OCSP response update.
The OCSP request/response is sent and received through an http_client
instance that has the dontlog-normal option set and that uses the regular
HTTP log format in case of error (unreachable OCSP responder for instance).
If such an error occurs, another log line that contains HTTP-related
information will then be emitted alongside the "regular" OCSP one (which will
likely have "HTTP error" as text status).
but if a purely HTTP error happens
(unreachable OCSP responder for instance), an extra log line that follows the
regular HTTP log-format will be emitted.
Here are two examples of such log lines, with a successful OCSP update log line first
and then an example of an HTTP error with the two different lines:
<134>Mar 6 11:16:53 haproxy[14872]: -:- [06/Mar/2023:11:16:52.808] <OCSP-UPDATE> /path_to_cert/foo.pem 1 "Update successful" 0 1
<134>Mar 6 11:18:55 haproxy[14872]: -:- [06/Mar/2023:11:18:54.207] <OCSP-UPDATE> /path_to_cert/bar.pem 2 "HTTP error" 1 0
<134>Mar 6 11:18:55 haproxy[14872]: -:- [06/Mar/2023:11:18:52.200] <OCSP-UPDATE> -/- 2/0/-1/-1/3009 503 217 - - SC-- 0/0/0/0/3 0/0 {} "GET http://127.0.0.1:12345/MEMwQTA%2FMD0wOzAJBgUrDgMCGgUABBSKg%2BAGD6%2F3Ccp%2Bm5VSKi6BY1%2FaCgQU9lKw5DXV6pI4UVCPCtvpLYXeAHoCAhAV HTTP/1.1"
prefer-client-ciphers
Use the client's preference when selecting the cipher suite, by default

19
src/ssl_ocsp.c
View File

@ -1301,7 +1301,7 @@ http_error:
return task;
}
char ocspupdate_log_format[] = "%ci:%cp [%tr] %ft %[ssl_ocsp_certid] %[ssl_ocsp_status] %{+Q}[ssl_ocsp_status_str] %[ssl_ocsp_fail_cnt] %[ssl_ocsp_success_cnt]";
char ocspupdate_log_format[] = "%ci:%cp [%tr] %ft %[ssl_ocsp_certname] %[ssl_ocsp_status] %{+Q}[ssl_ocsp_status_str] %[ssl_ocsp_fail_cnt] %[ssl_ocsp_success_cnt]";
/*
* Initialize the proxy for the OCSP update HTTP client with 2 servers, one for
@ -1310,7 +1310,7 @@ char ocspupdate_log_format[] = "%ci:%cp [%tr] %ft %[ssl_ocsp_certid] %[ssl_ocsp_
static int ssl_ocsp_update_precheck()
{
/* initialize the OCSP update dedicated httpclient */
httpclient_ocsp_update_px = httpclient_create_proxy("<HC_OCSP>");
httpclient_ocsp_update_px = httpclient_create_proxy("<OCSP-UPDATE>");
if (!httpclient_ocsp_update_px)
return 1;
httpclient_ocsp_update_px->conf.error_logformat_string = strdup(ocspupdate_log_format);
@ -2005,6 +2005,20 @@ smp_fetch_ssl_ocsp_certid(const struct arg *args, struct sample *smp, const char
return 1;
}
static int
smp_fetch_ssl_ocsp_certname(const struct arg *args, struct sample *smp, const char *kw, void *private)
{
struct certificate_ocsp *ocsp = ssl_ocsp_task_ctx.cur_ocsp;
if (!ocsp)
return 0;
smp->data.type = SMP_T_STR;
smp->data.u.str.area = ocsp->path;
smp->data.u.str.data = strlen(ocsp->path);
return 1;
}
static int
smp_fetch_ssl_ocsp_status(const struct arg *args, struct sample *smp, const char *kw, void *private)
{
@ -2085,6 +2099,7 @@ INITCALL1(STG_REGISTER, cli_register_kw, &cli_kws);
*/
static struct sample_fetch_kw_list sample_fetch_keywords = {ILH, {
{ "ssl_ocsp_certid", smp_fetch_ssl_ocsp_certid, 0, NULL, SMP_T_STR, SMP_USE_L5SRV },
{ "ssl_ocsp_certname", smp_fetch_ssl_ocsp_certname, 0, NULL, SMP_T_STR, SMP_USE_L5SRV },
{ "ssl_ocsp_status", smp_fetch_ssl_ocsp_status, 0, NULL, SMP_T_SINT, SMP_USE_L5SRV },
{ "ssl_ocsp_status_str", smp_fetch_ssl_ocsp_status_str, 0, NULL, SMP_T_STR, SMP_USE_L5SRV },
{ "ssl_ocsp_fail_cnt", smp_fetch_ssl_ocsp_fail_cnt, 0, NULL, SMP_T_SINT, SMP_USE_L5SRV },