MINOR: ssl: add pattern and ACLs fetches 'ssl_c_version' and 'ssl_f_version'
ssl_c_version : version of the cert presented by the client (integer)
ssl_f_version : version of the cert presented by the frontend (integer)
diff --git a/doc/configuration.txt b/doc/configuration.txt
index 3511676..0d92993 100644
--- a/doc/configuration.txt
+++ b/doc/configuration.txt
@@ -8384,11 +8384,21 @@
layer, and the verify result matches the specified value (check man verify
for possible values). Zero indicates no error was detected.
+ssl_c_version <integer>
+ Returns true when the incoming connection was made over an SSL/TLS transport
+ layer, and the version of the certificate presented by the client matches
+ the value.
+
ssl_f_serial <hexa>
Returns true when the incoming connection was made over an SSL/TLS transport
layer, and the serial of the certificate presented by the frontend matches
the value written in hexa.
+ssl_f_version <integer>
+ Returns true when the incoming connection was made over an SSL/TLS transport
+ layer, and the version of the certificate presented by the frontend matches
+ the value.
+
ssl_fc
Returns true when the front connection was made via an SSL/TLS transport
layer and is locally deciphered. This means it has matched a socket declared
@@ -9074,10 +9084,20 @@
was made over an SSL/TLS transport layer, otherwise zero if no
error is encountered.
+ ssl_c_version
+ Returns the version of the certificate presented by the client
+ when the incoming connection was made over an SSL/TLS transport
+ layer.
+
ssl_f_serial Returns the serial of the certificate presented by the frontend
when the incoming connection was made over an SSL/TLS transport
layer.
+ ssl_f_version
+ Returns the version of the certificate presented by the frontend
+ when the incoming connection was made over an SSL/TLS transport
+ layer.
+
ssl_fc This checks the transport layer used on the front connection,
and returns 1 if it was made via an SSL/TLS transport layer,
otherwise zero.
diff --git a/src/ssl_sock.c b/src/ssl_sock.c
index 914a5fd..73d97c2 100644
--- a/src/ssl_sock.c
+++ b/src/ssl_sock.c
@@ -1173,6 +1173,33 @@
return ret;
}
+/* integer, returns the client certificate version */
+static int
+smp_fetch_ssl_c_version(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
+ const struct arg *args, struct sample *smp)
+{
+ X509 *crt;
+
+ if (!l4 || l4->si[0].conn.xprt != &ssl_sock)
+ return 0;
+
+ if (!(l4->si[0].conn.flags & CO_FL_CONNECTED)) {
+ smp->flags |= SMP_F_MAY_CHANGE;
+ return 0;
+ }
+
+ /* SSL_get_peer_certificate returns a ptr on allocated X509 struct */
+ crt = SSL_get_peer_certificate(l4->si[0].conn.xprt_ctx);
+ if (!crt)
+ return 0;
+
+ smp->data.uint = (unsigned int)(1 + X509_get_version(crt));
+ X509_free(crt);
+ smp->type = SMP_T_UINT;
+
+ return 1;
+}
+
/* boolean, returns true if front conn. transport layer is SSL */
static int
smp_fetch_ssl_fc(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
@@ -1231,6 +1258,32 @@
return ret;
}
+/* integer, returns the frontend certificate version */
+static int
+smp_fetch_ssl_f_version(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
+ const struct arg *args, struct sample *smp)
+{
+ X509 *crt;
+
+ if (!l4 || l4->si[0].conn.xprt != &ssl_sock)
+ return 0;
+
+ if (!(l4->si[0].conn.flags & CO_FL_CONNECTED)) {
+ smp->flags |= SMP_F_MAY_CHANGE;
+ return 0;
+ }
+
+ /* SSL_get_certificate returns a ptr on an SSL * internal sub struct */
+ crt = SSL_get_certificate(l4->si[0].conn.xprt_ctx);
+ if (!crt)
+ return 0;
+
+ smp->data.uint = (unsigned int)(1 + X509_get_version(crt));
+ smp->type = SMP_T_UINT;
+
+ return 1;
+}
+
static int
smp_fetch_ssl_fc_cipher(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
const struct arg *args, struct sample *smp)
@@ -1947,7 +2000,9 @@
{ "ssl_c_err", smp_fetch_ssl_c_err, 0, NULL, SMP_T_UINT, SMP_CAP_REQ|SMP_CAP_RES },
{ "ssl_c_serial", smp_fetch_ssl_c_serial, 0, NULL, SMP_T_BIN, SMP_CAP_REQ|SMP_CAP_RES },
{ "ssl_c_verify", smp_fetch_ssl_c_verify, 0, NULL, SMP_T_UINT, SMP_CAP_REQ|SMP_CAP_RES },
+ { "ssl_c_version", smp_fetch_ssl_c_version, 0, NULL, SMP_T_UINT, SMP_CAP_REQ|SMP_CAP_RES },
{ "ssl_f_serial", smp_fetch_ssl_f_serial, 0, NULL, SMP_T_BIN, SMP_CAP_REQ|SMP_CAP_RES },
+ { "ssl_f_version", smp_fetch_ssl_f_version, 0, NULL, SMP_T_UINT, SMP_CAP_REQ|SMP_CAP_RES },
{ "ssl_fc", smp_fetch_ssl_fc, 0, NULL, SMP_T_BOOL, SMP_CAP_REQ|SMP_CAP_RES },
{ "ssl_fc_alg_keysize", smp_fetch_ssl_fc_alg_keysize, 0, NULL, SMP_T_UINT, SMP_CAP_REQ|SMP_CAP_RES },
{ "ssl_fc_cipher", smp_fetch_ssl_fc_cipher, 0, NULL, SMP_T_CSTR, SMP_CAP_REQ|SMP_CAP_RES },
@@ -1972,7 +2027,9 @@
{ "ssl_c_err", acl_parse_int, smp_fetch_ssl_c_err, acl_match_int, ACL_USE_L6REQ_PERMANENT|ACL_MAY_LOOKUP, 0 },
{ "ssl_c_serial", acl_parse_bin, smp_fetch_ssl_c_serial, acl_match_bin, ACL_USE_L6REQ_PERMANENT|ACL_MAY_LOOKUP, 0 },
{ "ssl_c_verify", acl_parse_int, smp_fetch_ssl_c_verify, acl_match_int, ACL_USE_L6REQ_PERMANENT|ACL_MAY_LOOKUP, 0 },
+ { "ssl_c_version", acl_parse_int, smp_fetch_ssl_c_version, acl_match_int, ACL_USE_L6REQ_PERMANENT|ACL_MAY_LOOKUP, 0 },
{ "ssl_f_serial", acl_parse_bin, smp_fetch_ssl_f_serial, acl_match_bin, ACL_USE_L6REQ_PERMANENT|ACL_MAY_LOOKUP, 0 },
+ { "ssl_f_version", acl_parse_int, smp_fetch_ssl_f_version, acl_match_int, ACL_USE_L6REQ_PERMANENT|ACL_MAY_LOOKUP, 0 },
{ "ssl_fc", acl_parse_int, smp_fetch_ssl_fc, acl_match_nothing, ACL_USE_L6REQ_PERMANENT|ACL_MAY_LOOKUP, 0 },
{ "ssl_fc_alg_keysize", acl_parse_str, smp_fetch_ssl_fc_alg_keysize, acl_match_int, ACL_USE_L6REQ_PERMANENT|ACL_MAY_LOOKUP, 0 },
{ "ssl_fc_cipher", acl_parse_str, smp_fetch_ssl_fc_cipher, acl_match_str, ACL_USE_L6REQ_PERMANENT|ACL_MAY_LOOKUP, 0 },