[thirdparty/squid.git] / src / ssl / helper.cc

/*
 * Copyright (C) 1996-2022 The Squid Software Foundation and contributors
 *
 * Squid software is distributed under GPLv2+ license and includes
 * contributions from numerous individuals and organizations.
 * Please see the COPYING and CONTRIBUTORS files for details.
 */

#include "squid.h"
#include "../helper.h"
#include "anyp/PortCfg.h"
#include "cache_cf.h"
#include "fs_io.h"
#include "helper/Reply.h"
#include "Parsing.h"
#include "sbuf/Stream.h"
#include "SquidConfig.h"
#include "SquidString.h"
#include "ssl/cert_validate_message.h"
#include "ssl/Config.h"
#include "ssl/helper.h"
#include "wordlist.h"

#include <limits>

Ssl::CertValidationHelper::CacheType *Ssl::CertValidationHelper::HelperCache = nullptr;

#if USE_SSL_CRTD

namespace Ssl {

/// Initiator of an Ssl::Helper query.
class GeneratorRequestor {
public:
    GeneratorRequestor(HLPCB *aCallback, void *aData): callback(aCallback), data(aData) {}
    HLPCB *callback;
    CallbackData data;
};

/// A pending Ssl::Helper request, combining the original and collapsed queries.
class GeneratorRequest {
    CBDATA_CLASS(GeneratorRequest);

public:
    /// adds a GeneratorRequestor
    void emplace(HLPCB *callback, void *data) { requestors.emplace_back(callback, data); }

    SBuf query; ///< Ssl::Helper request message (GeneratorRequests key)

    /// Ssl::Helper request initiators waiting for the same answer (FIFO).
    typedef std::vector<GeneratorRequestor> GeneratorRequestors;
    GeneratorRequestors requestors;
};

/// Ssl::Helper query:GeneratorRequest map
typedef std::unordered_map<SBuf, GeneratorRequest*> GeneratorRequests;

static void HandleGeneratorReply(void *data, const ::Helper::Reply &reply);

} // namespace Ssl

CBDATA_NAMESPACED_CLASS_INIT(Ssl, GeneratorRequest);

/// prints Ssl::GeneratorRequest for debugging
static std::ostream &
operator <<(std::ostream &os, const Ssl::GeneratorRequest &gr)
{
    return os << "crtGenRq" << gr.query.id.value << "/" << gr.requestors.size();
}

/// pending Ssl::Helper requests (to all certificate generator helpers combined)
static Ssl::GeneratorRequests TheGeneratorRequests;

helper *Ssl::Helper::ssl_crtd = nullptr;

void Ssl::Helper::Init()
{
    assert(ssl_crtd == nullptr);

    // we need to start ssl_crtd only if some port(s) need to bump SSL *and* generate certificates
    // TODO: generate host certificates for SNI enabled accel ports
    bool found = false;
    for (AnyP::PortCfgPointer s = HttpPortList; !found && s != nullptr; s = s->next)
        found = s->flags.tunnelSslBumping && s->secure.generateHostCertificates;
    if (!found)
        return;

    ssl_crtd = new helper("sslcrtd_program");
    ssl_crtd->childs.updateLimits(Ssl::TheConfig.ssl_crtdChildren);
    ssl_crtd->ipc_type = IPC_STREAM;
    // The crtd messages may contain the eol ('\n') character. We are
    // going to use the '\1' char as the end-of-message mark.
    ssl_crtd->eom = '\1';
    assert(ssl_crtd->cmdline == nullptr);
    {
        char *tmp = xstrdup(Ssl::TheConfig.ssl_crtd);
        char *tmp_begin = tmp;
        char *token = nullptr;
        while ((token = strwordtok(nullptr, &tmp))) {
            wordlistAdd(&ssl_crtd->cmdline, token);
        }
        safe_free(tmp_begin);
    }
    helperOpenServers(ssl_crtd);
}

void Ssl::Helper::Shutdown()
{
    if (!ssl_crtd)
        return;
    helperShutdown(ssl_crtd);
    wordlistDestroy(&ssl_crtd->cmdline);
    delete ssl_crtd;
    ssl_crtd = nullptr;
}

void
Ssl::Helper::Reconfigure()
{
    Shutdown();
    Init();
}

void Ssl::Helper::Submit(CrtdMessage const & message, HLPCB * callback, void * data)
{
    SBuf rawMessage(message.compose().c_str()); // XXX: helpers cannot use SBuf
    rawMessage.append("\n", 1);

    const auto pending = TheGeneratorRequests.find(rawMessage);
    if (pending != TheGeneratorRequests.end()) {
        pending->second->emplace(callback, data);
        debugs(83, 5, "collapsed request from " << data << " onto " << *pending->second);
        return;
    }

    GeneratorRequest *request = new GeneratorRequest;
    request->query = rawMessage;
    request->emplace(callback, data);
    TheGeneratorRequests.emplace(request->query, request);
    debugs(83, 5, "request from " << data << " as " << *request);
    // ssl_crtd becomes nil if Squid is reconfigured without SslBump or
    // certificate generation disabled in the new configuration
    if (ssl_crtd && ssl_crtd->trySubmit(request->query.c_str(), HandleGeneratorReply, request))
        return;

    ::Helper::Reply failReply(::Helper::BrokenHelper);
    failReply.notes.add("message", "error 45 Temporary network problem, please retry later");
    HandleGeneratorReply(request, failReply);
}

/// receives helper response
static void
Ssl::HandleGeneratorReply(void *data, const ::Helper::Reply &reply)
{
    const std::unique_ptr<Ssl::GeneratorRequest> request(static_cast<Ssl::GeneratorRequest*>(data));
    assert(request);
    const auto erased = TheGeneratorRequests.erase(request->query);
    assert(erased);

    for (auto &requestor: request->requestors) {
        if (void *cbdata = requestor.data.validDone()) {
            debugs(83, 5, "to " << cbdata << " in " << *request);
            requestor.callback(cbdata, reply);
        }
    }
}
#endif //USE_SSL_CRTD

helper *Ssl::CertValidationHelper::ssl_crt_validator = nullptr;

void Ssl::CertValidationHelper::Init()
{
    if (!Ssl::TheConfig.ssl_crt_validator)
        return;

    assert(ssl_crt_validator == nullptr);

    // we need to start ssl_crtd only if some port(s) need to bump SSL
    bool found = false;
    for (AnyP::PortCfgPointer s = HttpPortList; !found && s != nullptr; s = s->next)
        found = s->flags.tunnelSslBumping;
    if (!found)
        return;

    ssl_crt_validator = new helper("ssl_crt_validator");
    ssl_crt_validator->childs.updateLimits(Ssl::TheConfig.ssl_crt_validator_Children);
    ssl_crt_validator->ipc_type = IPC_STREAM;
    // The crtd messages may contain the eol ('\n') character. We are
    // going to use the '\1' char as the end-of-message mark.
    ssl_crt_validator->eom = '\1';
    assert(ssl_crt_validator->cmdline == nullptr);

    /* defaults */
    int ttl = 3600; // 1 hour
    size_t cache = 64*1024*1024; // 64 MB
    {
        // TODO: Do this during parseConfigFile() for proper parsing, error handling
        char *tmp = xstrdup(Ssl::TheConfig.ssl_crt_validator);
        char *tmp_begin = tmp;
        char * token = nullptr;
        bool parseParams = true;
        while ((token = strwordtok(nullptr, &tmp))) {
            if (parseParams) {
                if (strcmp(token, "ttl=infinity") == 0) {
                    ttl = std::numeric_limits<CacheType::Ttl>::max();
                    continue;
                } else if (strncmp(token, "ttl=", 4) == 0) {
                    ttl = xatoi(token + 4);
                    if (ttl < 0) {
                        throw TextException(ToSBuf("Negative TTL in sslcrtvalidator_program ", Ssl::TheConfig.ssl_crt_validator,
                                                   Debug::Extra, "For unlimited TTL, use ttl=infinity"),
                                            Here());
                    }
                    continue;
                } else if (strncmp(token, "cache=", 6) == 0) {
                    cache = xatoi(token + 6);
                    continue;
                } else
                    parseParams = false;
            }
            wordlistAdd(&ssl_crt_validator->cmdline, token);
        }
        xfree(tmp_begin);
    }
    helperOpenServers(ssl_crt_validator);

    //WARNING: initializing static member in an object initialization method
    assert(HelperCache == nullptr);
    HelperCache = new CacheType(cache, ttl);
}

void Ssl::CertValidationHelper::Shutdown()
{
    if (!ssl_crt_validator)
        return;
    helperShutdown(ssl_crt_validator);
    wordlistDestroy(&ssl_crt_validator->cmdline);
    delete ssl_crt_validator;
    ssl_crt_validator = nullptr;

    // CertValidationHelper::HelperCache is a static member, it is not good policy to
    // reset it here. Will work because the current Ssl::CertValidationHelper is
    // always the same static object.
    delete HelperCache;
    HelperCache = nullptr;
}

void
Ssl::CertValidationHelper::Reconfigure()
{
    Shutdown();
    Init();
}

class submitData
{
    CBDATA_CLASS(submitData);

public:
    SBuf query;
    AsyncCall::Pointer callback;
    Security::SessionPointer ssl;
};
CBDATA_CLASS_INIT(submitData);

static void
sslCrtvdHandleReplyWrapper(void *data, const ::Helper::Reply &reply)
{
    Ssl::CertValidationMsg replyMsg(Ssl::CrtdMessage::REPLY);

    submitData *crtdvdData = static_cast<submitData *>(data);
    assert(crtdvdData->ssl.get());
    Ssl::CertValidationResponse::Pointer validationResponse = new Ssl::CertValidationResponse(crtdvdData->ssl);
    if (reply.result == ::Helper::BrokenHelper) {
        debugs(83, DBG_IMPORTANT, "ERROR: \"ssl_crtvd\" helper error response: " << reply.other().content());
        validationResponse->resultCode = ::Helper::BrokenHelper;
    } else if (!reply.other().hasContent()) {
        debugs(83, DBG_IMPORTANT, "\"ssl_crtvd\" helper returned NULL response");
        validationResponse->resultCode = ::Helper::BrokenHelper;
    } else if (replyMsg.parse(reply.other().content(), reply.other().contentSize()) != Ssl::CrtdMessage::OK ||
               !replyMsg.parseResponse(*validationResponse) ) {
        debugs(83, DBG_IMPORTANT, "WARNING: Reply from ssl_crtvd for " << " is incorrect");
        debugs(83, DBG_IMPORTANT, "ERROR: Certificate cannot be validated. ssl_crtvd response: " << replyMsg.getBody());
        validationResponse->resultCode = ::Helper::BrokenHelper;
    } else
        validationResponse->resultCode = reply.result;

    Ssl::CertValidationHelper::CbDialer *dialer = dynamic_cast<Ssl::CertValidationHelper::CbDialer*>(crtdvdData->callback->getDialer());
    Must(dialer);
    dialer->arg1 = validationResponse;
    ScheduleCallHere(crtdvdData->callback);

    if (Ssl::CertValidationHelper::HelperCache &&
            (validationResponse->resultCode == ::Helper::Okay || validationResponse->resultCode == ::Helper::Error)) {
        (void)Ssl::CertValidationHelper::HelperCache->add(crtdvdData->query, validationResponse);
    }

    delete crtdvdData;
}

void Ssl::CertValidationHelper::Submit(Ssl::CertValidationRequest const &request, AsyncCall::Pointer &callback)
{
    Ssl::CertValidationMsg message(Ssl::CrtdMessage::REQUEST);
    message.setCode(Ssl::CertValidationMsg::code_cert_validate);
    message.composeRequest(request);
    debugs(83, 5, "SSL crtvd request: " << message.compose().c_str());

    submitData *crtdvdData = new submitData;
    crtdvdData->query.assign(message.compose().c_str());
    crtdvdData->query.append('\n');
    crtdvdData->callback = callback;
    crtdvdData->ssl = request.ssl;
    Ssl::CertValidationResponse::Pointer const*validationResponse;

    if (CertValidationHelper::HelperCache &&
            (validationResponse = CertValidationHelper::HelperCache->get(crtdvdData->query))) {

        CertValidationHelper::CbDialer *dialer = dynamic_cast<CertValidationHelper::CbDialer*>(callback->getDialer());
        Must(dialer);
        dialer->arg1 = *validationResponse;
        ScheduleCallHere(callback);
        delete crtdvdData;
        return;
    }

    // ssl_crt_validator becomes nil if Squid is reconfigured with cert
    // validator disabled in the new configuration
    if (ssl_crt_validator && ssl_crt_validator->trySubmit(crtdvdData->query.c_str(), sslCrtvdHandleReplyWrapper, crtdvdData))
        return;

    Ssl::CertValidationResponse::Pointer resp = new Ssl::CertValidationResponse(crtdvdData->ssl);
    resp->resultCode = ::Helper::BrokenHelper;
    Ssl::CertValidationHelper::CbDialer *dialer = dynamic_cast<Ssl::CertValidationHelper::CbDialer*>(callback->getDialer());
    Must(dialer);
    dialer->arg1 = resp;
    ScheduleCallHere(callback);
    delete crtdvdData;
    return;
}
Commit	Line	Data
bbc27441	1	/*
bf95c10a	2	* Copyright (C) 1996-2022 The Squid Software Foundation and contributors
bbc27441 AJ	3	*
	4	* Squid software is distributed under GPLv2+ license and includes
	5	* contributions from numerous individuals and organizations.
	6	* Please see the COPYING and CONTRIBUTORS files for details.
	7	*/
	8
f7f3304a	9	#include "squid.h"
24438ec5	10	#include "../helper.h"
502bcc7b	11	#include "anyp/PortCfg.h"
72247610	12	#include "cache_cf.h"
b3f7fd88	13	#include "fs_io.h"
24438ec5	14	#include "helper/Reply.h"
72247610	15	#include "Parsing.h"
70ac5b29	16	#include "sbuf/Stream.h"
602d9612	17	#include "SquidConfig.h"
f9b6ff6e	18	#include "SquidString.h"
14798e73	19	#include "ssl/cert_validate_message.h"
602d9612 A	20	#include "ssl/Config.h"
602d9612 A	21	#include "ssl/helper.h"
fc54b8d2	22	#include "wordlist.h"
95d2589c	23
1f8b5f0e	24	#include <limits>
1f8b5f0e	25
72247610	26	Ssl::CertValidationHelper::CacheType *Ssl::CertValidationHelper::HelperCache = nullptr;
968b000d	27
58fa3f51 CT	28	#if USE_SSL_CRTD
	29
	30	namespace Ssl {
	31
	32	/// Initiator of an Ssl::Helper query.
	33	class GeneratorRequestor {
	34	public:
	35	GeneratorRequestor(HLPCB aCallback, void aData): callback(aCallback), data(aData) {}
	36	HLPCB *callback;
	37	CallbackData data;
	38	};
	39
	40	/// A pending Ssl::Helper request, combining the original and collapsed queries.
	41	class GeneratorRequest {
	42	CBDATA_CLASS(GeneratorRequest);
	43
	44	public:
	45	/// adds a GeneratorRequestor
	46	void emplace(HLPCB callback, void data) { requestors.emplace_back(callback, data); }
	47
	48	SBuf query; ///< Ssl::Helper request message (GeneratorRequests key)
	49
	50	/// Ssl::Helper request initiators waiting for the same answer (FIFO).
	51	typedef std::vector<GeneratorRequestor> GeneratorRequestors;
	52	GeneratorRequestors requestors;
	53	};
	54
	55	/// Ssl::Helper query:GeneratorRequest map
	56	typedef std::unordered_map<SBuf, GeneratorRequest*> GeneratorRequests;
	57
	58	static void HandleGeneratorReply(void *data, const ::Helper::Reply &reply);
	59
	60	} // namespace Ssl
	61
	62	CBDATA_NAMESPACED_CLASS_INIT(Ssl, GeneratorRequest);
	63
	64	/// prints Ssl::GeneratorRequest for debugging
	65	static std::ostream &
	66	operator <<(std::ostream &os, const Ssl::GeneratorRequest &gr)
	67	{
	68	return os << "crtGenRq" << gr.query.id.value << "/" << gr.requestors.size();
	69	}
	70
	71	/// pending Ssl::Helper requests (to all certificate generator helpers combined)
	72	static Ssl::GeneratorRequests TheGeneratorRequests;
	73
23da195f	74	helper *Ssl::Helper::ssl_crtd = nullptr;
95d2589c CT	75
	76	void Ssl::Helper::Init()
	77	{
aee3523a	78	assert(ssl_crtd == nullptr);
586089cd	79
f0763147 AJ	80	// we need to start ssl_crtd only if some port(s) need to bump SSL and generate certificates
f0763147 AJ	81	// TODO: generate host certificates for SNI enabled accel ports
24e6c8f1	82	bool found = false;
aee3523a	83	for (AnyP::PortCfgPointer s = HttpPortList; !found && s != nullptr; s = s->next)
cf487124	84	found = s->flags.tunnelSslBumping && s->secure.generateHostCertificates;
24e6c8f1	85	if (!found)
586089cd CT	86	return;
586089cd CT	87
91ce75c9	88	ssl_crtd = new helper("sslcrtd_program");
1af735c7	89	ssl_crtd->childs.updateLimits(Ssl::TheConfig.ssl_crtdChildren);
95d2589c	90	ssl_crtd->ipc_type = IPC_STREAM;
0af9303a CT	91	// The crtd messages may contain the eol ('\n') character. We are
	92	// going to use the '\1' char as the end-of-message mark.
	93	ssl_crtd->eom = '\1';
aee3523a	94	assert(ssl_crtd->cmdline == nullptr);
95d2589c CT	95	{
	96	char *tmp = xstrdup(Ssl::TheConfig.ssl_crtd);
	97	char *tmp_begin = tmp;
aee3523a AR	98	char *token = nullptr;
aee3523a AR	99	while ((token = strwordtok(nullptr, &tmp))) {
95d2589c	100	wordlistAdd(&ssl_crtd->cmdline, token);
95d2589c CT	101	}
	102	safe_free(tmp_begin);
	103	}
95d2589c CT	104	helperOpenServers(ssl_crtd);
	105	}
	106
	107	void Ssl::Helper::Shutdown()
	108	{
	109	if (!ssl_crtd)
	110	return;
	111	helperShutdown(ssl_crtd);
	112	wordlistDestroy(&ssl_crtd->cmdline);
95d2589c	113	delete ssl_crtd;
aee3523a	114	ssl_crtd = nullptr;
95d2589c CT	115	}
95d2589c CT	116
23da195f CT	117	void
23da195f CT	118	Ssl::Helper::Reconfigure()
95d2589c	119	{
23da195f CT	120	Shutdown();
	121	Init();
	122	}
95d2589c	123
23da195f CT	124	void Ssl::Helper::Submit(CrtdMessage const & message, HLPCB * callback, void * data)
23da195f CT	125	{
58fa3f51 CT	126	SBuf rawMessage(message.compose().c_str()); // XXX: helpers cannot use SBuf
	127	rawMessage.append("\n", 1);
	128
	129	const auto pending = TheGeneratorRequests.find(rawMessage);
	130	if (pending != TheGeneratorRequests.end()) {
	131	pending->second->emplace(callback, data);
	132	debugs(83, 5, "collapsed request from " << data << " onto " << *pending->second);
	133	return;
	134	}
	135
	136	GeneratorRequest *request = new GeneratorRequest;
	137	request->query = rawMessage;
	138	request->emplace(callback, data);
	139	TheGeneratorRequests.emplace(request->query, request);
	140	debugs(83, 5, "request from " << data << " as " << *request);
23da195f CT	141	// ssl_crtd becomes nil if Squid is reconfigured without SslBump or
	142	// certificate generation disabled in the new configuration
	143	if (ssl_crtd && ssl_crtd->trySubmit(request->query.c_str(), HandleGeneratorReply, request))
95d2589c	144	return;
58fa3f51 CT	145
	146	::Helper::Reply failReply(::Helper::BrokenHelper);
	147	failReply.notes.add("message", "error 45 Temporary network problem, please retry later");
	148	HandleGeneratorReply(request, failReply);
	149	}
	150
	151	/// receives helper response
	152	static void
	153	Ssl::HandleGeneratorReply(void *data, const ::Helper::Reply &reply)
	154	{
	155	const std::unique_ptr<Ssl::GeneratorRequest> request(static_cast<Ssl::GeneratorRequest*>(data));
	156	assert(request);
	157	const auto erased = TheGeneratorRequests.erase(request->query);
	158	assert(erased);
	159
	160	for (auto &requestor: request->requestors) {
	161	if (void *cbdata = requestor.data.validDone()) {
	162	debugs(83, 5, "to " << cbdata << " in " << *request);
	163	requestor.callback(cbdata, reply);
	164	}
95d2589c	165	}
95d2589c	166	}
4a77bb4e	167	#endif //USE_SSL_CRTD
2cef0ca6	168
23da195f	169	helper *Ssl::CertValidationHelper::ssl_crt_validator = nullptr;
2cef0ca6 AR	170
	171	void Ssl::CertValidationHelper::Init()
	172	{
23da195f CT	173	if (!Ssl::TheConfig.ssl_crt_validator)
	174	return;
	175
aee3523a	176	assert(ssl_crt_validator == nullptr);
2cef0ca6 AR	177
	178	// we need to start ssl_crtd only if some port(s) need to bump SSL
	179	bool found = false;
aee3523a	180	for (AnyP::PortCfgPointer s = HttpPortList; !found && s != nullptr; s = s->next)
6a25a046	181	found = s->flags.tunnelSslBumping;
2cef0ca6 AR	182	if (!found)
	183	return;
	184
	185	ssl_crt_validator = new helper("ssl_crt_validator");
	186	ssl_crt_validator->childs.updateLimits(Ssl::TheConfig.ssl_crt_validator_Children);
	187	ssl_crt_validator->ipc_type = IPC_STREAM;
	188	// The crtd messages may contain the eol ('\n') character. We are
	189	// going to use the '\1' char as the end-of-message mark.
	190	ssl_crt_validator->eom = '\1';
aee3523a	191	assert(ssl_crt_validator->cmdline == nullptr);
14798e73	192
72247610 AJ	193	/* defaults */
	194	int ttl = 3600; // 1 hour
	195	size_t cache = 6410241024; // 64 MB
2cef0ca6	196	{
72247610	197	// TODO: Do this during parseConfigFile() for proper parsing, error handling
2cef0ca6 AR	198	char *tmp = xstrdup(Ssl::TheConfig.ssl_crt_validator);
2cef0ca6 AR	199	char *tmp_begin = tmp;
aee3523a	200	char * token = nullptr;
14798e73	201	bool parseParams = true;
aee3523a	202	while ((token = strwordtok(nullptr, &tmp))) {
14798e73	203	if (parseParams) {
72247610 AJ	204	if (strcmp(token, "ttl=infinity") == 0) {
	205	ttl = std::numeric_limits<CacheType::Ttl>::max();
	206	continue;
	207	} else if (strncmp(token, "ttl=", 4) == 0) {
	208	ttl = xatoi(token + 4);
	209	if (ttl < 0) {
	210	throw TextException(ToSBuf("Negative TTL in sslcrtvalidator_program ", Ssl::TheConfig.ssl_crt_validator,
70ac5b29	211	Debug::Extra, "For unlimited TTL, use ttl=infinity"),
70ac5b29	212	Here());
72247610	213	}
14798e73 CT	214	continue;
14798e73 CT	215	} else if (strncmp(token, "cache=", 6) == 0) {
72247610	216	cache = xatoi(token + 6);
14798e73 CT	217	continue;
	218	} else
	219	parseParams = false;
	220	}
2cef0ca6 AR	221	wordlistAdd(&ssl_crt_validator->cmdline, token);
2cef0ca6 AR	222	}
4a77bb4e	223	xfree(tmp_begin);
2cef0ca6 AR	224	}
2cef0ca6 AR	225	helperOpenServers(ssl_crt_validator);
14798e73 CT	226
14798e73 CT	227	//WARNING: initializing static member in an object initialization method
aee3523a	228	assert(HelperCache == nullptr);
72247610	229	HelperCache = new CacheType(cache, ttl);
2cef0ca6 AR	230	}
	231
	232	void Ssl::CertValidationHelper::Shutdown()
	233	{
	234	if (!ssl_crt_validator)
	235	return;
	236	helperShutdown(ssl_crt_validator);
	237	wordlistDestroy(&ssl_crt_validator->cmdline);
	238	delete ssl_crt_validator;
aee3523a	239	ssl_crt_validator = nullptr;
4c304fb9	240
14798e73	241	// CertValidationHelper::HelperCache is a static member, it is not good policy to
4c304fb9	242	// reset it here. Will work because the current Ssl::CertValidationHelper is
14798e73 CT	243	// always the same static object.
14798e73 CT	244	delete HelperCache;
aee3523a	245	HelperCache = nullptr;
14798e73 CT	246	}
14798e73 CT	247
23da195f CT	248	void
	249	Ssl::CertValidationHelper::Reconfigure()
	250	{
	251	Shutdown();
	252	Init();
	253	}
	254
5c2f68b7 AJ	255	class submitData
	256	{
	257	CBDATA_CLASS(submitData);
	258
	259	public:
5107d2c4	260	SBuf query;
0e208dad	261	AsyncCall::Pointer callback;
e601ca5d	262	Security::SessionPointer ssl;
14798e73 CT	263	};
	264	CBDATA_CLASS_INIT(submitData);
	265
	266	static void
24438ec5	267	sslCrtvdHandleReplyWrapper(void *data, const ::Helper::Reply &reply)
14798e73 CT	268	{
14798e73 CT	269	Ssl::CertValidationMsg replyMsg(Ssl::CrtdMessage::REPLY);
14798e73 CT	270
14798e73 CT	271	submitData crtdvdData = static_cast<submitData >(data);
8fe1a85a CT	272	assert(crtdvdData->ssl.get());
8fe1a85a CT	273	Ssl::CertValidationResponse::Pointer validationResponse = new Ssl::CertValidationResponse(crtdvdData->ssl);
2428ce02	274	if (reply.result == ::Helper::BrokenHelper) {
d816f28d	275	debugs(83, DBG_IMPORTANT, "ERROR: \"ssl_crtvd\" helper error response: " << reply.other().content());
2428ce02	276	validationResponse->resultCode = ::Helper::BrokenHelper;
ddc77a2e CT	277	} else if (!reply.other().hasContent()) {
	278	debugs(83, DBG_IMPORTANT, "\"ssl_crtvd\" helper returned NULL response");
	279	validationResponse->resultCode = ::Helper::BrokenHelper;
14798e73	280	} else if (replyMsg.parse(reply.other().content(), reply.other().contentSize()) != Ssl::CrtdMessage::OK \|\|
8b082ed9	281	!replyMsg.parseResponse(*validationResponse) ) {
14798e73	282	debugs(83, DBG_IMPORTANT, "WARNING: Reply from ssl_crtvd for " << " is incorrect");
d816f28d	283	debugs(83, DBG_IMPORTANT, "ERROR: Certificate cannot be validated. ssl_crtvd response: " << replyMsg.getBody());
2428ce02	284	validationResponse->resultCode = ::Helper::BrokenHelper;
4c304fb9	285	} else
14798e73 CT	286	validationResponse->resultCode = reply.result;
14798e73 CT	287
0e208dad CT	288	Ssl::CertValidationHelper::CbDialer dialer = dynamic_cast<Ssl::CertValidationHelper::CbDialer>(crtdvdData->callback->getDialer());
	289	Must(dialer);
	290	dialer->arg1 = validationResponse;
	291	ScheduleCallHere(crtdvdData->callback);
14798e73 CT	292
14798e73 CT	293	if (Ssl::CertValidationHelper::HelperCache &&
2428ce02	294	(validationResponse->resultCode == ::Helper::Okay \|\| validationResponse->resultCode == ::Helper::Error)) {
72247610	295	(void)Ssl::CertValidationHelper::HelperCache->add(crtdvdData->query, validationResponse);
0e208dad	296	}
14798e73	297
14798e73	298	delete crtdvdData;
2cef0ca6 AR	299	}
2cef0ca6 AR	300
23da195f	301	void Ssl::CertValidationHelper::Submit(Ssl::CertValidationRequest const &request, AsyncCall::Pointer &callback)
2cef0ca6	302	{
14798e73 CT	303	Ssl::CertValidationMsg message(Ssl::CrtdMessage::REQUEST);
	304	message.setCode(Ssl::CertValidationMsg::code_cert_validate);
	305	message.composeRequest(request);
	306	debugs(83, 5, "SSL crtvd request: " << message.compose().c_str());
	307
	308	submitData *crtdvdData = new submitData;
5107d2c4 CT	309	crtdvdData->query.assign(message.compose().c_str());
5107d2c4 CT	310	crtdvdData->query.append('\n');
14798e73	311	crtdvdData->callback = callback;
0b168d25	312	crtdvdData->ssl = request.ssl;
0e208dad	313	Ssl::CertValidationResponse::Pointer const*validationResponse;
14798e73 CT	314
14798e73 CT	315	if (CertValidationHelper::HelperCache &&
5107d2c4	316	(validationResponse = CertValidationHelper::HelperCache->get(crtdvdData->query))) {
0e208dad CT	317
0e208dad CT	318	CertValidationHelper::CbDialer dialer = dynamic_cast<CertValidationHelper::CbDialer>(callback->getDialer());
bac324a9	319	Must(dialer);
0e208dad CT	320	dialer->arg1 = *validationResponse;
0e208dad CT	321	ScheduleCallHere(callback);
14798e73 CT	322	delete crtdvdData;
	323	return;
	324	}
6825b101	325
23da195f CT	326	// ssl_crt_validator becomes nil if Squid is reconfigured with cert
	327	// validator disabled in the new configuration
	328	if (ssl_crt_validator && ssl_crt_validator->trySubmit(crtdvdData->query.c_str(), sslCrtvdHandleReplyWrapper, crtdvdData))
6825b101	329	return;
23da195f CT	330
	331	Ssl::CertValidationResponse::Pointer resp = new Ssl::CertValidationResponse(crtdvdData->ssl);
	332	resp->resultCode = ::Helper::BrokenHelper;
	333	Ssl::CertValidationHelper::CbDialer dialer = dynamic_cast<Ssl::CertValidationHelper::CbDialer>(callback->getDialer());
	334	Must(dialer);
	335	dialer->arg1 = resp;
	336	ScheduleCallHere(callback);
	337	delete crtdvdData;
	338	return;
2cef0ca6	339	}
f53969cc	340