* Much like _store_ssl_ctx, but this updates the existing lookup entries rather than creating them * If it fails to create the new SSL_CTX, don't invalidate the lookup structure, just keep working with the * previous entry */
| 1718 | * previous entry |
| 1719 | */ |
| 1720 | bool |
| 1721 | SSLMultiCertConfigLoader::update_ssl_ctx(const std::string &secret_name) |
| 1722 | { |
| 1723 | bool retval = true; |
| 1724 | |
| 1725 | SSLCertificateConfig::scoped_config lookup; |
| 1726 | if (!lookup) { |
| 1727 | // SSLCertificateConfig is still being configured, thus there are no SSL |
| 1728 | // contexts to update. This situation can happen during startup if a |
| 1729 | // registered hook updates certs before SSLCertContext configuration is |
| 1730 | // complete. |
| 1731 | return retval; |
| 1732 | } |
| 1733 | std::set<shared_SSLMultiCertConfigParams> policies; |
| 1734 | lookup->getPolicies(secret_name, policies); |
| 1735 | |
| 1736 | for (auto policy_iter = policies.begin(); policy_iter != policies.end() && retval; ++policy_iter) { |
| 1737 | std::set<std::string> common_names; |
| 1738 | std::unordered_map<int, std::set<std::string>> unique_names; |
| 1739 | SSLMultiCertConfigLoader::CertLoadData data; |
| 1740 | if (!this->_prep_ssl_ctx(*policy_iter, data, common_names, unique_names)) { |
| 1741 | retval = false; |
| 1742 | break; |
| 1743 | } |
| 1744 | |
| 1745 | std::vector<SSLLoadingContext> ctxs = this->init_server_ssl_ctx(data, policy_iter->get()); |
| 1746 | for (const auto &loadingctx : ctxs) { |
| 1747 | shared_SSL_CTX ctx(loadingctx.ctx, SSL_CTX_free); |
| 1748 | |
| 1749 | if (!ctx) { |
| 1750 | retval = false; |
| 1751 | } else { |
| 1752 | for (auto const &name : common_names) { |
| 1753 | SSLCertContext *cc = lookup->find(name, loadingctx.ctx_type); |
| 1754 | if (cc && cc->userconfig.get() == policy_iter->get()) { |
| 1755 | cc->setCtx(ctx); |
| 1756 | } |
| 1757 | } |
| 1758 | } |
| 1759 | } |
| 1760 | |
| 1761 | for (auto iter = unique_names.begin(); retval && iter != unique_names.end(); ++iter) { |
| 1762 | size_t i = iter->first; |
| 1763 | |
| 1764 | SSLMultiCertConfigLoader::CertLoadData single_data; |
| 1765 | single_data.cert_names_list.push_back(data.cert_names_list[i]); |
| 1766 | single_data.key_list.push_back(i < data.key_list.size() ? data.key_list[i] : ""); |
| 1767 | single_data.ca_list.push_back(i < data.ca_list.size() ? data.ca_list[i] : ""); |
| 1768 | single_data.ocsp_list.push_back(i < data.ocsp_list.size() ? data.ocsp_list[i] : ""); |
| 1769 | |
| 1770 | std::vector<SSLLoadingContext> ctxs = this->init_server_ssl_ctx(single_data, policy_iter->get()); |
| 1771 | for (auto const &loadingctx : ctxs) { |
| 1772 | shared_SSL_CTX unique_ctx(loadingctx.ctx, SSL_CTX_free); |
| 1773 | |
| 1774 | if (!unique_ctx) { |
| 1775 | retval = false; |
| 1776 | } else { |
| 1777 | for (auto const &name : iter->second) { |
no test coverage detected