From ssl-2.5 2004/12/02 00:53:40

%USER_CERTCHAIN external_acl_type tag, returning the complete client SSL
certificate chain

diff --git a/src/cf.data.pre b/src/cf.data.pre
index 13e17b789285822ae7b0b5212cfa3a34e89fb8a3..85b7c8b5b7191adfbfa42c4cf5d9823626117042 100644 (file)
--- a/src/cf.data.pre
+++ b/src/cf.data.pre
@@ -1,6 +1,6 @@
 
 #
-# $Id: cf.data.pre,v 1.384 2005/03/18 17:12:34 hno Exp $
+# $Id: cf.data.pre,v 1.385 2005/03/18 17:17:51 hno Exp $
 #
 #
 # SQUID Web Proxy Cache          http://www.squid-cache.org/
@@ -1997,6 +1997,7 @@ DOC_START
          %MYADDR       Squid interface address
          %MYPORT       Squid http_port number
          %USER_CERT    SSL User certificate in PEM format
+         %USER_CERTCHAIN SSL User certificate chain in PEM format
          %USER_CERT_xx SSL User certificate subject attribute xx
          %USER_CA_xx   SSL User certificate issuer attribute xx
          %{Header}     HTTP request header

diff --git a/src/external_acl.cc b/src/external_acl.cc
index 0c2c15d67224722c15f0e80c0c5d1390bb3e205b..47daa43e67c0640fcfaec11982133d526c21df75 100644 (file)
--- a/src/external_acl.cc
+++ b/src/external_acl.cc
@@ -1,6 +1,6 @@
 
 /*
- * $Id: external_acl.cc,v 1.59 2005/03/18 16:51:22 hno Exp $
+ * $Id: external_acl.cc,v 1.60 2005/03/18 17:17:51 hno Exp $
  *
  * DEBUG: section 82    External ACL
  * AUTHOR: Henrik Nordstrom, MARA Systems AB
@@ -149,6 +149,7 @@ struct _external_acl_format
         EXT_ACL_USER_CERT,
         EXT_ACL_CA_CERT,
         EXT_ACL_USER_CERT_RAW,
+        EXT_ACL_USER_CERTCHAIN_RAW,
 #endif
         EXT_ACL_EXT_USER,
         EXT_ACL_END
@@ -344,6 +345,8 @@ parse_externalAclHelper(external_acl ** list)
 
         else if (strcmp(token, "%USER_CERT") == 0)
             format->type = EXT_ACL_USER_CERT_RAW;
+        else if (strcmp(token, "%USER_CERTCHAIN") == 0)
+            format->type = EXT_ACL_USER_CERTCHAIN_RAW;
         else if (strncmp(token, "%USER_CERT_", 11)) {
             format->type = _external_acl_format::EXT_ACL_USER_CERT;
             format->header = xstrdup(token + 11);
@@ -451,6 +454,10 @@ dump_externalAclHelper(StoreEntry * sentry, const char *name, const external_acl
                 storeAppendPrintf(sentry, " %%USER_CERT");
                 break;
 
+            case _external_acl_format::EXT_ACL_USER_CERTCHAIN_RAW:
+                storeAppendPrintf(sentry, " %%USER_CERTCHAIN");
+                break;
+
             case _external_acl_format::EXT_ACL_USER_CERT:
                 storeAppendPrintf(sentry, " %%USER_CERT_%s", format->header);
                 break;
@@ -804,6 +811,17 @@ makeExternalAclKey(ACLChecklist * ch, external_acl_data * acl_data)
 
             break;
 
+        case _external_acl_format::EXT_ACL_USER_CERTCHAIN_RAW:
+
+            if (ch->conn().getRaw()) {
+                SSL *ssl = fd_table[ch->conn()->fd].ssl;
+
+                if (ssl)
+                    str = sslGetUserCertificateChainPEM(ssl);
+            }
+
+            break;
+
         case _external_acl_format::EXT_ACL_USER_CERT:
 
             if (ch->conn().getRaw()) {

diff --git a/src/ssl_support.cc b/src/ssl_support.cc
index d2801106a54d38af590dc89e2e2fe7974be6f597..3ed990580fee8735f98dcef1e781241626fd4c4e 100644 (file)
--- a/src/ssl_support.cc
+++ b/src/ssl_support.cc
@@ -1,6 +1,6 @@
 
 /*
- * $Id: ssl_support.cc,v 1.29 2005/03/18 17:12:34 hno Exp $
+ * $Id: ssl_support.cc,v 1.30 2005/03/18 17:17:51 hno Exp $
  *
  * AUTHOR: Benno Rice
  * DEBUG: section 83    SSL accelerator support
@@ -1021,3 +1021,41 @@ sslGetUserCertificatePEM(SSL *ssl)
 
     return str;
 }
+
+const char *
+sslGetUserCertificateChainPEM(SSL *ssl)
+{
+    STACK_OF(X509) *chain;
+    BIO *mem;
+    static char *str = NULL;
+    char *ptr;
+    long len;
+    int i;
+
+    safe_free(str);
+
+    if (!ssl)
+        return NULL;
+
+    chain = SSL_get_peer_cert_chain(ssl);
+
+    if (!chain)
+        return sslGetUserCertificatePEM(ssl);
+
+    mem = BIO_new(BIO_s_mem());
+
+    for (i = 0; i < sk_X509_num(chain); i++) {
+        X509 *cert = sk_X509_value(chain, i);
+        PEM_write_bio_X509(mem, cert);
+    }
+
+    len = BIO_get_mem_data(mem, &ptr);
+
+    str = (char *)xmalloc(len + 1);
+    memcpy(str, ptr, len);
+    str[len] = '\0';
+
+    BIO_free(mem);
+
+    return str;
+}

diff --git a/src/ssl_support.h b/src/ssl_support.h
index f5306f1127c0947d2ae38d7336ca5e0df764d571..959399dfba89160c4ae741193a8b1de3907c1c1d 100644 (file)
--- a/src/ssl_support.h
+++ b/src/ssl_support.h
@@ -1,6 +1,6 @@
 
 /*
- * $Id: ssl_support.h,v 1.11 2005/03/18 17:12:34 hno Exp $
+ * $Id: ssl_support.h,v 1.12 2005/03/18 17:17:51 hno Exp $
  *
  * AUTHOR: Benno Rice
  *
@@ -57,5 +57,6 @@ typedef char const *SSLGETATTRIBUTE(SSL *, const char *);
 SSLGETATTRIBUTE sslGetUserAttribute;
 SSLGETATTRIBUTE sslGetCAAttribute;
 const char *sslGetUserCertificatePEM(SSL *ssl);
+const char *sslGetUserCertificateChainPEM(SSL *ssl);
 
 #endif /* SQUID_SSL_SUPPORT_H */