Skip to content

Commit 55580a0

Browse files
committed
OCSP: FetchSM initialization check
Delay OCSP fetch until FetchSM is initialized. This avoids noisy OCSP error messages on ATS initialization that result when the FetchSM calls fail each attempted OCSP cert fetch. Fixes: #9819
1 parent b1e9327 commit 55580a0

File tree

7 files changed

+39
-5
lines changed

7 files changed

+39
-5
lines changed

include/proxy/FetchSM.h

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,12 @@ class FetchSM : public Continuation
3838
{
3939
public:
4040
FetchSM() {}
41+
42+
/** Indicate whether FetchSM dependencies have been initialized by ATS.
43+
* @return True if FetchSM dependencies have been initialized, false otherwise.
44+
*/
45+
static bool is_initialized();
46+
4147
void
4248
init_comm()
4349
{

include/proxy/PluginHttpConnect.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,4 +25,5 @@
2525

2626
#include "proxy/PluginVC.h"
2727

28+
bool PluginHttpConnectIsInitialized();
2829
PluginVC *PluginHttpConnectInternal(TSHttpConnectOptions *options);

src/iocore/net/OCSPStapling.cc

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1284,13 +1284,19 @@ stapling_refresh_response(certinfo *cinf, TS_OCSP_RESPONSE **prsp)
12841284
return rv;
12851285
}
12861286

1287-
void
1287+
OCSPStatus
12881288
ocsp_update()
12891289
{
1290+
if (!FetchSM::is_initialized()) {
1291+
Dbg(dbg_ctl_ssl_ocsp, "FetchSM is not yet initialized. Skipping OCSP update.");
1292+
return OCSPStatus::OCSP_FETCHSM_NOT_INITIALIZED;
1293+
}
12901294
shared_SSL_CTX ctx;
12911295
TS_OCSP_RESPONSE *resp = nullptr;
12921296
time_t current_time;
12931297

1298+
Note("OCSP refresh started");
1299+
12941300
SSLCertificateConfig::scoped_config certLookup;
12951301

12961302
Dbg(dbg_ctl_ssl_ocsp, "updating OCSP data");
@@ -1332,6 +1338,8 @@ ocsp_update()
13321338
}
13331339
}
13341340
}
1341+
Note("OCSP refresh finished");
1342+
return OCSPStatus::OCSP_OK;
13351343
}
13361344

13371345
// RFC 6066 Section-8: Certificate Status Request

src/iocore/net/P_OCSPStapling.h

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,11 @@
2525

2626
void ssl_stapling_ex_init();
2727
bool ssl_stapling_init_cert(SSL_CTX *ctx, X509 *cert, const char *certname, const char *rsp_file);
28-
void ocsp_update();
28+
29+
enum class OCSPStatus {
30+
OCSP_OK,
31+
OCSP_FETCHSM_NOT_INITIALIZED,
32+
};
33+
OCSPStatus ocsp_update();
2934

3035
int ssl_callback_ocsp_stapling(SSL *, void *);

src/iocore/net/SSLNetProcessor.cc

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -38,9 +38,11 @@ struct OCSPContinuation : public Continuation {
3838
int
3939
mainEvent(int /* event ATS_UNUSED */, Event * /* e ATS_UNUSED */)
4040
{
41-
Note("OCSP refresh started");
42-
ocsp_update();
43-
Note("OCSP refresh finished");
41+
if (ocsp_update() == OCSPStatus::OCSP_FETCHSM_NOT_INITIALIZED) {
42+
Note("Delaying OCSP fetching until FetchSM is initialized.");
43+
this_ethread()->schedule_in(this, HRTIME_SECONDS(1));
44+
return EVENT_CONT;
45+
}
4446
return EVENT_CONT;
4547
}
4648

src/proxy/FetchSM.cc

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,12 @@ DbgCtl dbg_ctl{DEBUG_TAG};
4040

4141
} // end anonymous namespace
4242

43+
bool
44+
FetchSM::is_initialized()
45+
{
46+
return PluginHttpConnectIsInitialized();
47+
}
48+
4349
void
4450
FetchSM::cleanUp()
4551
{

src/proxy/PluginHttpConnect.cc

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,12 @@
2626

2727
extern HttpSessionAccept *plugin_http_accept;
2828

29+
bool
30+
PluginHttpConnectIsInitialized()
31+
{
32+
return plugin_http_accept != nullptr;
33+
}
34+
2935
PluginVC *
3036
PluginHttpConnectInternal(TSHttpConnectOptions *options)
3137
{

0 commit comments

Comments
 (0)