upstream/haproxy
1
0
Fork 0
mirror of https://github.com/haproxy/haproxy.git synced 2026-02-20 00:10:41 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions 14
haproxy/include/types
History
William Lallemand 150bfa84e3 MEDIUM: ssl/cli: 'set ssl cert' updates a certificate from the CLI 
$ echo -e "set ssl cert certificate.pem <<\n$(cat certificate2.pem)\n" | \
    socat stdio /var/run/haproxy.stat
    Certificate updated!

The operation is locked at the ckch level with a HA_SPINLOCK_T which
prevents the ckch architecture (ckch_store, ckch_inst..) to be modified
at the same time. So you can't do a certificate update at the same time
from multiple CLI connections.

SNI trees are also locked with a HA_RWLOCK_T so reading operations are
locked only during a certificate update.

Bundles are supported but you need to update each file (.rsa|ecdsa|.dsa)
independently. If a file is used in the configuration as a bundle AND
as a unique certificate, both will be updated.

Bundles, directories and crt-list are supported, however filters in
crt-list are currently unsupported.

The code tries to allocate every SNIs and certificate instances first,
so it can rollback the operation if that was unsuccessful.

If you have too much instances of the certificate (at least 20000 in my
tests on my laptop), the function can take too much time and be killed
by the watchdog. This will be fixed later. Also with too much
certificates it's possible that socat exits before the end of the
generation without displaying a message, consider changing the socat
timeout in this case (-t2 for example).

The size of the certificate is currently limited by the maximum size of
a payload, that must fit in a buffer.
2019-10-11 17:32:03 +02:00
..
acl.h REORG/MAJOR: session: rename the "session" entity to "stream" 2015-04-06 11:23:56 +02:00
action.h MINOR: action: Add the return code ACT_RET_DONE for actions 2019-07-05 14:26:14 +02:00
activity.h MAJOR: fd: Get rid of the fd cache. 2019-07-31 14:12:55 +02:00
applet.h MINOR: cli: extend the CLI context with a list and two offsets 2019-08-30 11:58:58 +02:00
arg.h MEDIUM: stick-table: Stop handling stick-tables as proxies. 2019-05-07 06:54:06 +02:00
auth.h MAJOR: auth: Change the internal authentication system. 2014-03-17 18:06:06 +01:00
backend.h MEDIUM: backend: move all LB algo parameters into an union 2019-01-14 19:33:17 +01:00
capture.h CLEANUP: pools: rename all pool functions and pointers to remove this "2" 2017-11-24 17:49:53 +01:00
channel.h CLEANUP: channel: Remove the unused flag CF_WAKE_CONNECT 2019-07-19 09:24:12 +02:00
checks.h MEDIUM: connection: Upstream SOCKS4 proxy support 2019-05-31 17:24:06 +02:00
cli.h MINOR: cli: add two new states to print messages on the CLI 2019-08-09 10:11:38 +02:00
compression.h MAJOR: buffer: finalize buffer detachment 2018-07-19 16:23:43 +02:00
connection.h MINOR: connection: add the fc_pp_authority fetch -- authority TLV, from PROXYv2 2019-08-28 17:16:20 +02:00
counters.h MINOR: cache: report the number of cache lookups and cache hits 2018-12-14 14:00:25 +01:00
dict.h MINOR: dict: Store the length of the dictionary entries. 2019-06-07 15:47:54 +02:00
dns.h BUG/MEDIUM: dns: make the port numbers unsigned 2019-05-22 20:07:45 +02:00
fcgi-app.h MEDIUM: fcgi-app: Add FCGI application and filter 2019-09-17 10:18:54 +02:00
fd.h MINOR: fd: add two flags ERR and SHUT to describe FD states 2019-09-06 18:33:07 +02:00
filters.h MAJOR: filters: Remove code relying on the legacy HTTP mode 2019-07-19 09:18:27 +02:00
freq_ctr.h [MINOR] freq_ctr: add new types and functions for periods different from 1s 2010-08-10 14:01:09 +02:00
global.h MEDIUM: list: Separate "locked" list from regular list. 2019-09-23 18:16:08 +02:00
hlua.h MINOR: hlua: Add a flag on the lua txn to know in which context it can be used 2019-07-29 11:17:52 +02:00
http_ana.h MINOR: http-ana: Remove err_state field from http_msg 2019-09-17 10:18:54 +02:00
http_htx.h REORG: htx: merge types+proto into common/htx.h 2018-12-11 17:15:04 +01:00
lb_chash.h MINOR: backend: move hash_balance_factor out of chash 2019-01-14 19:33:17 +01:00
lb_fas.h MEDIUM: backend: add the 'first' balancing algorithm 2012-02-21 22:27:27 +01:00
lb_fwlc.h [MEDIUM] build: switch ebtree users to use new ebtree version 2009-10-26 21:10:04 +01:00
lb_fwrr.h [MEDIUM] build: switch ebtree users to use new ebtree version 2009-10-26 21:10:04 +01:00
lb_map.h MEDIUM: threads/lb: Make LB algorithms (lb_*.c) thread-safe 2017-10-31 13:58:31 +01:00
listener.h MEDIUM: ssl/cli: 'set ssl cert' updates a certificate from the CLI 2019-10-11 17:32:03 +02:00
log.h MEDIUM: log: add support for logging to a ring buffer 2019-08-30 15:24:59 +02:00
mailers.h MINOR: mailers: make it possible to configure the connection timeout 2016-02-20 15:33:06 +01:00
map.h CLEANUP: map: it seems that the map were planed to be chained 2016-03-30 15:41:15 +02:00
obj_type.h MINOR: obj_type: new object type for struct stream 2019-04-23 11:35:56 +02:00
pattern.h MINOR: threads: Use __decl_hathreads to declare locks 2017-11-13 11:38:17 +01:00
peers.h MINOR: peers: Optimization for dictionary cache lookup. 2019-06-07 15:47:54 +02:00
pipe.h [MEDIUM] introduce pipe pools 2009-01-25 13:49:53 +01:00
port_range.h BUG/MEDIUM: port_range: Make the ring buffer lock-free. 2019-04-30 15:10:17 +02:00
proto_udp.h MEDIUM: protocol: add minimalist UDP protocol client 2015-06-13 22:07:35 +02:00
protocol.h BUG/MEDIUM: protocols: add a global lock for the init/deinit stuff 2019-07-24 16:45:02 +02:00
protocol_buffers.h MINOR: sample: Rework gRPC converter code. 2019-03-05 11:04:23 +01:00
proxy.h MEDIUM: list: Separate "locked" list from regular list. 2019-09-23 18:16:08 +02:00
queue.h MINOR: queue: replace the linked list with a tree 2018-08-10 15:06:27 +02:00
ring.h MEDIUM: ring: implement a wait mode for watchers 2019-08-30 11:58:58 +02:00
sample.h MAJOR: http: Remove the HTTP legacy code 2019-07-19 09:24:12 +02:00
server.h MEDIUM: list: Separate "locked" list from regular list. 2019-09-23 18:16:08 +02:00
session.h MEDIUM: sessions: Introduce session flags. 2019-05-29 15:41:47 +02:00
shctx.h MINOR: shctx: Change max. object size type to unsigned int. 2018-10-26 04:54:40 +02:00
signal.h [MEDIUM] signals: add support for registering functions and tasks 2010-08-27 18:00:40 +02:00
sink.h MINOR: sink: now report the number of dropped events on output 2019-08-27 17:14:19 +02:00
spoe.h MINOR: spoe: Support the async mode with several threads 2019-09-26 16:51:02 +02:00
ssl_sock.h MEDIUM: ssl/cli: 'set ssl cert' updates a certificate from the CLI 2019-10-11 17:32:03 +02:00
stats.h MINOR: stats: support the "desc" output format modifier for info and stat 2019-10-10 11:30:07 +02:00
stick_table.h MINOR: stick-table: Add "server_name" new data type. 2019-06-05 08:33:35 +02:00
stream.h BUG/MEDIUM: proxy: Make sure to destroy the stream on upgrade from TCP to H2 2019-08-02 18:28:58 +02:00
stream_interface.h MEDIUM: stream-int: introduce a new state SI_ST_RDY 2019-06-06 16:36:19 +02:00
task.h MEDIUM: task: Split the tasklet list into two lists. 2019-10-11 16:37:41 +02:00
template.h [CLEANUP] included common/version.h everywhere 2006-06-29 18:54:54 +02:00
trace.h MINOR: trace: change the detail_level to per-source verbosity 2019-08-29 17:11:25 +02:00
vars.h MINOR: threads: Use __decl_hathreads to declare locks 2017-11-13 11:38:17 +01:00