SourceFormat Enforcement

[thirdparty/squid.git] / src / acl / CertificateData.cc

diff --git a/src/acl/CertificateData.cc b/src/acl/CertificateData.cc
index 9170387014b86a33aae8b647147362c8eac71ec2..65ef118b4c5ac117e0074f0cb5e7702ffcc18968 100644 (file)
--- a/src/acl/CertificateData.cc
+++ b/src/acl/CertificateData.cc
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1996-2014 The Squid Software Foundation and contributors
+ * Copyright (C) 1996-2017 The Squid Software Foundation and contributors
  *
  * Squid software is distributed under GPLv2+ license and includes
  * contributions from numerous individuals and organizations.
@@ -12,6 +12,7 @@
 #include "acl/CertificateData.h"
 #include "acl/Checklist.h"
 #include "cache_cf.h"
+#include "ConfigParser.h"
 #include "Debug.h"
 #include "wordlist.h"
 
@@ -71,13 +72,6 @@ ACLCertificateData::match(X509 *cert)
     return values.match(value);
 }
 
-struct CertificateDataAclDumpVisitor {
-    SBufList contents;
-    void operator() (char * const & node_data) {
-        contents.push_back(SBuf(node_data));
-    }
-};
-
 SBufList
 ACLCertificateData::dump() const
 {
@@ -85,9 +79,13 @@ ACLCertificateData::dump() const
     if (validAttributesStr)
         sl.push_back(SBuf(attribute));
 
-    CertificateDataAclDumpVisitor visitor;
-    values.values->visit(visitor);
-    sl.splice(sl.end(),visitor.contents);
+#if __cplusplus >= 201103L
+    sl.splice(sl.end(),values.dump());
+#else
+    // temp is needed until c++11 move constructor
+    SBufList tmp = values.dump();
+    sl.splice(sl.end(),tmp);
+#endif
     return sl;
 }
 
@@ -95,14 +93,14 @@ void
 ACLCertificateData::parse()
 {
     if (validAttributesStr) {
-        char *newAttribute = strtokFile();
+        char *newAttribute = ConfigParser::strtokFile();
 
         if (!newAttribute) {
-            if (attributeIsOptional)
-                return;
-
-            debugs(28, DBG_CRITICAL, "FATAL: required attribute argument missing");
-            self_destruct();
+            if (!attributeIsOptional) {
+                debugs(28, DBG_CRITICAL, "FATAL: required attribute argument missing");
+                self_destruct();
+            }
+            return;
         }
 
         // Handle the cases where we have optional -x type attributes
@@ -121,6 +119,7 @@ ACLCertificateData::parse()
             if (!valid) {
                 debugs(28, DBG_CRITICAL, "FATAL: Unknown option. Supported option(s) are: " << validAttributesStr);
                 self_destruct();
+                return;
             }
 
             /* an acl must use consistent attributes in all config lines */
@@ -128,9 +127,32 @@ ACLCertificateData::parse()
                 if (strcasecmp(newAttribute, attribute) != 0) {
                     debugs(28, DBG_CRITICAL, "FATAL: An acl must use consistent attributes in all config lines (" << newAttribute << "!=" << attribute << ").");
                     self_destruct();
+                    return;
+                }
+            } else {
+                if (strcasecmp(newAttribute, "DN") != 0) {
+                    int nid = OBJ_txt2nid(newAttribute);
+                    if (nid == 0) {
+                        const size_t span = strspn(newAttribute, "0123456789.");
+                        if(newAttribute[span] == '\0') { // looks like a numerical OID
+                            // create a new object based on this attribute
+
+                            // NOTE: Not a [bad] leak: If the same attribute
+                            // has been added before, the OBJ_txt2nid call
+                            // would return a valid nid value.
+                            // TODO: call OBJ_cleanup() on reconfigure?
+                            nid = OBJ_create(newAttribute, newAttribute,  newAttribute);
+                            debugs(28, 7, "New SSL certificate attribute created with name: " << newAttribute << " and nid: " << nid);
+                        }
+                    }
+                    if (nid == 0) {
+                        debugs(28, DBG_CRITICAL, "FATAL: Not valid SSL certificate attribute name or numerical OID: " << newAttribute);
+                        self_destruct();
+                        return;
+                    }
                 }
-            } else
                 attribute = xstrdup(newAttribute);
+            }
         }
     }