From ssl-2.5 2004/10/22 14:52:33

%USER_CERT external_acl_type giving the user certificate in PEM format

diff --git a/src/cf.data.pre b/src/cf.data.pre
index 6068cfa60136f2c6403b06caea04b541c7ddceeb..676502d7986f0d2988b2df72fc27a3908aaac9d7 100644 (file)
--- a/src/cf.data.pre
+++ b/src/cf.data.pre
@@ -1,6 +1,6 @@
 
 #
-# $Id: cf.data.pre,v 1.382 2005/03/18 16:32:37 hno Exp $
+# $Id: cf.data.pre,v 1.383 2005/03/18 16:51:22 hno Exp $
 #
 #
 # SQUID Web Proxy Cache          http://www.squid-cache.org/
@@ -1986,8 +1986,9 @@ DOC_START
          %METHOD       Request method
          %MYADDR       Squid interface address
          %MYPORT       Squid http_port number
-         %USER_CERT_xx SSL User certificate attribute xx
-         %USER_CA_xx   SSL User certificate CA attribute xx
+         %USER_CERT    SSL User certificate in PEM format
+         %USER_CERT_xx SSL User certificate subject attribute xx
+         %USER_CA_xx   SSL User certificate issuer attribute xx
          %{Header}     HTTP request header
          %{Hdr:member} HTTP request header list member
          %{Hdr:;member}

diff --git a/src/external_acl.cc b/src/external_acl.cc
index c62511315fafbdb11e624eeb06c2ff4fbbc3a4bf..0c2c15d67224722c15f0e80c0c5d1390bb3e205b 100644 (file)
--- a/src/external_acl.cc
+++ b/src/external_acl.cc
@@ -1,6 +1,6 @@
 
 /*
- * $Id: external_acl.cc,v 1.58 2004/08/30 05:12:31 robertc Exp $
+ * $Id: external_acl.cc,v 1.59 2005/03/18 16:51:22 hno Exp $
  *
  * DEBUG: section 82    External ACL
  * AUTHOR: Henrik Nordstrom, MARA Systems AB
@@ -148,6 +148,7 @@ struct _external_acl_format
 #if USE_SSL
         EXT_ACL_USER_CERT,
         EXT_ACL_CA_CERT,
+        EXT_ACL_USER_CERT_RAW,
 #endif
         EXT_ACL_EXT_USER,
         EXT_ACL_END
@@ -341,6 +342,8 @@ parse_externalAclHelper(external_acl ** list)
 
 #if USE_SSL
 
+        else if (strcmp(token, "%USER_CERT") == 0)
+            format->type = EXT_ACL_USER_CERT_RAW;
         else if (strncmp(token, "%USER_CERT_", 11)) {
             format->type = _external_acl_format::EXT_ACL_USER_CERT;
             format->header = xstrdup(token + 11);
@@ -444,6 +447,10 @@ dump_externalAclHelper(StoreEntry * sentry, const char *name, const external_acl
                 DUMP_EXT_ACL_TYPE(METHOD);
 #if USE_SSL
 
+            case _external_acl_format::EXT_ACL_USER_CERT_RAW:
+                storeAppendPrintf(sentry, " %%USER_CERT");
+                break;
+
             case _external_acl_format::EXT_ACL_USER_CERT:
                 storeAppendPrintf(sentry, " %%USER_CERT_%s", format->header);
                 break;
@@ -786,6 +793,17 @@ makeExternalAclKey(ACLChecklist * ch, external_acl_data * acl_data)
             break;
 #if USE_SSL
 
+        case _external_acl_format::EXT_ACL_USER_CERT_RAW:
+
+            if (ch->conn().getRaw()) {
+                SSL *ssl = fd_table[ch->conn()->fd].ssl;
+
+                if (ssl)
+                    str = sslGetUserCertificatePEM(ssl);
+            }
+
+            break;
+
         case _external_acl_format::EXT_ACL_USER_CERT:
 
             if (ch->conn().getRaw()) {

diff --git a/src/ssl_support.cc b/src/ssl_support.cc
index dabce4d289eea2c721fe780e80d654370215f9a9..961729b95cdd7dc8753f523da33fc2ec12b5a242 100644 (file)
--- a/src/ssl_support.cc
+++ b/src/ssl_support.cc
@@ -1,6 +1,6 @@
 
 /*
- * $Id: ssl_support.cc,v 1.27 2005/03/18 16:46:44 hno Exp $
+ * $Id: ssl_support.cc,v 1.28 2005/03/18 16:51:22 hno Exp $
  *
  * AUTHOR: Benno Rice
  * DEBUG: section 83    SSL accelerator support
@@ -918,3 +918,42 @@ sslGetUserEmail(SSL * ssl)
 {
     return sslGetUserAttribute(ssl, "Email");
 }
+
+const char *
+sslGetUserCertificatePEM(SSL *ssl)
+{
+    X509 *cert;
+    BIO *mem;
+    static char *str = NULL;
+    char *ptr;
+    long len;
+
+    safe_free(str);
+
+    if (!ssl)
+        return NULL;
+
+    cert = SSL_get_peer_certificate(ssl);
+
+    if (!cert)
+        return NULL;
+
+    mem = BIO_new(BIO_s_mem());
+
+    PEM_write_bio_X509(mem, cert);
+
+
+    len = BIO_get_mem_data(mem, &ptr);
+
+    str = (char *)xmalloc(len + 1);
+
+    memcpy(str, ptr, len);
+
+    str[len] = '\0';
+
+    X509_free(cert);
+
+    BIO_free(mem);
+
+    return str;
+}

diff --git a/src/ssl_support.h b/src/ssl_support.h
index b00276e1534a69379f274468122409c740b51784..a1b5fbda04ad753a64a2a49afe3a54d6c2a44e58 100644 (file)
--- a/src/ssl_support.h
+++ b/src/ssl_support.h
@@ -1,6 +1,6 @@
 
 /*
- * $Id: ssl_support.h,v 1.9 2005/03/18 15:36:08 hno Exp $
+ * $Id: ssl_support.h,v 1.10 2005/03/18 16:51:22 hno Exp $
  *
  * AUTHOR: Benno Rice
  *
@@ -56,5 +56,6 @@ const char *sslGetUserEmail(SSL *ssl);
 typedef char const *SSLGETATTRIBUTE(SSL *, const char *);
 SSLGETATTRIBUTE sslGetUserAttribute;
 SSLGETATTRIBUTE sslGetCAAttribute;
+const char *sslGetUserCertificatePEM(SSL *ssl);
 
 #endif /* SQUID_SSL_SUPPORT_H */