From: Christopher Faulet <cfaulet@haproxy.com>
Date: Wed, 16 Sep 2026 07:19:21 +0000 (+0200)
Subject: BUG/MEDIUM: ssl/ocsp: Set HTTPCLIENT_O_RES_ACCUM option on the http-client
X-Git-Tag: v3.5-dev8~185
X-Git-Url: https://git.kaiwu.me/$%7BGITURL%7D$%7Bcid%7D?a=commitdiff_plain;h=31d6f02eba69b72db747ca5296319cb2da349e01;p=haproxy.git

BUG/MEDIUM: ssl/ocsp: Set HTTPCLIENT_O_RES_ACCUM option on the http-client

The OCSP update task does not consume the response payload on the fly. It
waits for the end of the response to check and load the OCSP response stored
in the http-client response buffer.

Thus, since commit b24260ec9 ("BUG/MEDIUM: http-client: Only consume input
buffer when hc one is empty"), the http-client applet stops to consume data
as soon as the first part of the payload is stored in its response buffer,
waiting for the caller to consume it. But it never happens. So, when the
OCSP response is not received in one time, the update is stuck till the
server timeout expiration and always fails.

The HTTPCLIENT_O_RES_ACCUM option is now set to instruct the http-client to
continue to fill its response buffer.

This patch depends on :

  * BUG/MEDIUM: http-client: Don't use the httpclient context if it was released
  * MINOR: http-client: Add an option to not stop the reception of the response

It should fix issue #3498. It must be backported as far as 3.3 with commit
b24260ec9.
---

diff --git a/src/ssl_ocsp.c b/src/ssl_ocsp.c
index 8079bcb23..fe89d2554 100644
--- a/src/ssl_ocsp.c
+++ b/src/ssl_ocsp.c
@@ -1429,6 +1429,11 @@ static struct task *ssl_ocsp_update_responses(struct task *task, void *context,
 			goto leave;
 		}
 
+		/* The response payload is not consumed on the fly. It is
+		 * retrieved at the end of the response.
+		 */
+		hc->options |= HTTPCLIENT_O_RES_ACCUM;
+
 		hc->ops.res_stline = ocsp_update_response_stline_cb;
 		hc->ops.res_headers = ocsp_update_response_headers_cb;
 		hc->ops.res_payload = ocsp_update_response_body_cb;