Fix %USER_CA_CERT_* and %CA_CERT_ external_acl formating codes

* The attribute part of the %USER_CA_CERT_xx and %CA_CERT_xx formating codes
  is not parsed correctly, make these formating codes useless.
* The %USER_CA_CERT_xx documented wrongly

diff --git a/src/cf.data.pre b/src/cf.data.pre
index b4b2c208ddd64955c7ffe446cb2328fd1bde8438..3d27099ca79c0f1aca359bf23ad65ec8bf368409 100644 (file)
--- a/src/cf.data.pre
+++ b/src/cf.data.pre
@@ -715,7 +715,7 @@ DOC_START
          %USER_CERT    SSL User certificate in PEM format
          %USER_CERTCHAIN SSL User certificate chain in PEM format
          %USER_CERT_xx SSL User certificate subject attribute xx
-         %USER_CA_xx   SSL User certificate issuer attribute xx
+         %USER_CA_CERT_xx SSL User certificate issuer attribute xx
 
          %>{Header}    HTTP request header "Header"
          %>{Hdr:member}

diff --git a/src/external_acl.cc b/src/external_acl.cc
index 33451377d8fce274a3101c8a14cfe07389c7d1e7..b762e2217487206dee9a1eaaf53e54f408db28fb 100644 (file)
--- a/src/external_acl.cc
+++ b/src/external_acl.cc
@@ -473,13 +473,13 @@ parse_externalAclHelper(external_acl ** list)
         else if (strncmp(token, "%USER_CERT_", 11) == 0) {
             format->type = _external_acl_format::EXT_ACL_USER_CERT;
             format->header = xstrdup(token + 11);
-        } else if (strncmp(token, "%USER_CA_CERT_", 11) == 0) {
+        } else if (strncmp(token, "%USER_CA_CERT_", 14) == 0) {
             format->type = _external_acl_format::EXT_ACL_USER_CA_CERT;
-            format->header = xstrdup(token + 11);
-        } else if (strncmp(token, "%CA_CERT_", 11) == 0) {
+            format->header = xstrdup(token + 14);
+        } else if (strncmp(token, "%CA_CERT_", 9) == 0) {
             debugs(82, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: external_acl_type %CA_CERT_* code is obsolete. Use %USER_CA_CERT_* instead");
             format->type = _external_acl_format::EXT_ACL_USER_CA_CERT;
-            format->header = xstrdup(token + 11);
+            format->header = xstrdup(token + 9);
         }
 #endif
 #if USE_AUTH