tree 8059e4891d29a8f1bec8bec1610dac2bf5de5405
parent f81c70ceececceb83131c04039c3a67b52aefbd0
author Remi Tricot-Le Breton <rlebreton@haproxy.com> 1618933094 +0200
committer William Lallemand <wlallemand@haproxy.org> 1621241424 +0200

MEDIUM: ssl: Add "set+commit ssl crl-file" CLI commands

This patch adds the "set ssl crl-file" and "commit ssl crl-file"
commands, following the same logic as the certificate and CA file update
equivalents.
When trying to update a Certificate Revocation List (CRL) file via a
"set" command, we start by looking for the entry in the CA file tree and
then building a new cafile_entry out of the payload, without adding it
to the tree yet. It will only be added when a "commit" command is
called.
During a "commit" command, we insert the newly built cafile_entry in the
CA file tree while keeping the previous entry. We then iterate over all
the instances that used the CRL file and rebuild a new one and its
dedicated SSL context for every one of them.
When all the contexts are properly created, the old instances get
replaced by the new ones and the old CRL file is removed from the tree.