Send selected SSL version and cipher to the certificate validation helper.

This patch sends the selected cipher suite and the selected SSL/TLS version
to the certificate verification helper using the "proto_version=v" and
"cipher=c" key=value pairs.

This is a Measurement Factory project

diff --git a/helpers/ssl/cert_valid.pl b/helpers/ssl/cert_valid.pl
index b1177b654e3e5306319d8ffd9ad2f0c4e10554b3..ebc3bb3c3fd17de03587622906bbd238a6e2ecc6 100755 (executable)
--- a/helpers/ssl/cert_valid.pl
+++ b/helpers/ssl/cert_valid.pl
@@ -99,9 +99,13 @@ while (<>) {
 
         print(STDERR logPrefix()."GOT ". "Code=".$code." $bodylen \n") if ($debug); #.$body;
         my $hostname;
-        parseRequest($body, \$hostname, \%errors, \%certs);
+        my $sslVersion = "-";
+        my $sslCipher = "-";
+        parseRequest($body, \$hostname, \$sslVersion, \$sslCipher, \%errors, \%certs);
         print(STDERR logPrefix()."Parse result: \n") if ($debug);
         print(STDERR logPrefix()."\tFOUND host:".$hostname."\n") if ($debug);
+        print(STDERR logPrefix()."\tFOUND ssl version:".$sslVersion."\n") if ($debug);
+        print(STDERR logPrefix()."\tFOUND ssl cipher:".$sslCipher."\n") if ($debug);
         print(STDERR logPrefix()."\tFOUND ERRORS:") if ($debug);
         foreach my $err (keys %errors) {
             print(STDERR logPrefix().$errors{$err}{"name"}."/".$errors{$err}{"cert"}." ,")  if ($debug);
@@ -173,6 +177,8 @@ sub parseRequest
 {
     my($request)=shift;
     my $hostname = shift;
+    my $sslVersion = shift;
+    my $sslCipher = shift;
     my $errors = shift;
     my $certs = shift;
     while ($request !~ /^\s*$/) {
@@ -183,6 +189,12 @@ sub parseRequest
             $$hostname = $host;
             $request =~ s/^host=.*$//m;
         }
+        if ($request =~ s/^proto_version=(.*?)$//m) {
+            $$sslVersion = $1;
+        }
+        if ($request =~ s/^cipher=(.*?)$//m) {
+            $$sslCipher = $1;
+        }
         if ($request =~ /^cert_(\d+)=/) {
             my $certId = "cert_".$1;
             my($vallen) = index($request, "-----END CERTIFICATE-----") + length("-----END CERTIFICATE-----");

diff --git a/src/ssl/cert_validate_message.cc b/src/ssl/cert_validate_message.cc
index 57337c300311998e744f710eb049d8de0f85d787..f0d9f8ebdc912f5ef24177aeebaeb17746046dea 100644 (file)
--- a/src/ssl/cert_validate_message.cc
+++ b/src/ssl/cert_validate_message.cc
@@ -21,6 +21,12 @@ Ssl::CertValidationMsg::composeRequest(CertValidationRequest const &vcert)
     body += Ssl::CertValidationMsg::param_host + "=" + vcert.domainName;
     STACK_OF(X509) *peerCerts = static_cast<STACK_OF(X509) *>(SSL_get_ex_data(vcert.ssl, ssl_ex_index_ssl_cert_chain));
 
+    if (const char *sslVersion = SSL_get_version(vcert.ssl))
+        body += "\n" +  Ssl::CertValidationMsg::param_proto_version + "=" + sslVersion;
+
+    if (const char *cipherName = SSL_CIPHER_get_name(SSL_get_current_cipher(vcert.ssl)))
+        body += "\n" +  Ssl::CertValidationMsg::param_cipher + "=" + cipherName;
+
     if (!peerCerts)
         peerCerts = SSL_get_peer_cert_chain(vcert.ssl);
 
@@ -231,4 +237,5 @@ const std::string Ssl::CertValidationMsg::param_cert("cert_");
 const std::string Ssl::CertValidationMsg::param_error_name("error_name_");
 const std::string Ssl::CertValidationMsg::param_error_reason("error_reason_");
 const std::string Ssl::CertValidationMsg::param_error_cert("error_cert_");
-
+const std::string Ssl::CertValidationMsg::param_proto_version("proto_version");
+const std::string Ssl::CertValidationMsg::param_cipher("cipher");

diff --git a/src/ssl/cert_validate_message.h b/src/ssl/cert_validate_message.h
index a77aa827efe47b5ea848899c8205fdef0e4df6af..7578415ba09a8e5e974ca707ede164f23fcfdf2e 100644 (file)
--- a/src/ssl/cert_validate_message.h
+++ b/src/ssl/cert_validate_message.h
@@ -113,6 +113,10 @@ public:
     static const std::string param_error_reason;
     /// Parameter name for passing the error cert ID
     static const std::string param_error_cert;
+    /// Parameter name for SSL version
+    static const std::string param_proto_version;
+    /// Parameter name for SSL cipher
+    static const std::string param_cipher;
 };
 
 }//namespace Ssl