RepoMirrors/haproxy
1
0
Fork 0
mirror of http://git.haproxy.org/git/haproxy.git/ synced 2025-04-09 10:47:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

MINOR: ssl: x509_v_err_str converter transforms an integer to a X509_V_ERR name

Browse Source 
The x509_v_err_str converter transforms a numerical X509 verify error
to its constant name.
This commit is contained in:
William Lallemand 2022-11-03 18:56:37 +01:00
parent 960fb74cae
commit 9fbc84e571
3 changed files with 42 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
doc/configuration.txt
View File

@ -18171,6 +18171,26 @@ xxh64([<seed>])
collision rate, though care must be taken as the algorithm is not considered collision rate, though care must be taken as the algorithm is not considered
as cryptographically secure. as cryptographically secure.
x509_v_err_str
Convert a numerical value to its corresponding X509_V_ERR constant name. It
is useful in ACL in order to have a configuration which works with multiple
version of OpenSSL since some codes might change when changing version.
The list of constant provided by OpenSSL can be found at
https://www.openssl.org/docs/manmaster/man3/X509_STORE_CTX_get_error.html#ERROR-CODES
Be careful to read the page for the right version of OpenSSL.
Example:
bind :443 ssl crt common.pem ca-file ca-auth.crt verify optional crt-ignore-err X509_V_ERR_CERT_REVOKED,X509_V_ERR_CERT_HAS_EXPIRED
acl cert_expired ssl_c_verify,x509_v_err_str -m str X509_V_ERR_CERT_HAS_EXPIRED
acl cert_revoked ssl_c_verify,x509_v_err_str -m str X509_V_ERR_CERT_REVOKED
acl cert_ok ssl_c_verify,x509_v_err_str -m str X509_V_OK
http-response add-header X-SSL Ok if cert_ok
http-response add-header X-SSL Expired if cert_expired
http-response add-header X-SSL Revoked if cert_revoked
7.3.2. Fetching samples from internal states 7.3.2. Fetching samples from internal states
-------------------------------------------- --------------------------------------------

6
reg-tests/ssl/ssl_client_auth.vtc
View File

@ -50,9 +50,9 @@ haproxy h1 -conf {
# crl-file: revocation list for client auth: the client1 certificate is revoked # crl-file: revocation list for client auth: the client1 certificate is revoked
bind "${tmpdir}/ssl.sock" ssl crt ${testdir}/common.pem ca-file ${testdir}/ca-auth.crt verify optional crt-ignore-err X509_V_ERR_CERT_REVOKED,X509_V_ERR_CERT_HAS_EXPIRED crl-file ${testdir}/crl-auth.pem bind "${tmpdir}/ssl.sock" ssl crt ${testdir}/common.pem ca-file ${testdir}/ca-auth.crt verify optional crt-ignore-err X509_V_ERR_CERT_REVOKED,X509_V_ERR_CERT_HAS_EXPIRED crl-file ${testdir}/crl-auth.pem
acl cert_expired ssl_c_verify 10 acl cert_expired ssl_c_verify,x509_v_err_str -m str X509_V_ERR_CERT_HAS_EXPIRED
acl cert_revoked ssl_c_verify 23 acl cert_revoked ssl_c_verify,x509_v_err_str -m str X509_V_ERR_CERT_REVOKED
acl cert_ok ssl_c_verify 0 acl cert_ok ssl_c_verify,x509_v_err_str -m str X509_V_OK
http-response add-header X-SSL Ok if cert_ok http-response add-header X-SSL Ok if cert_ok
http-response add-header X-SSL Expired if cert_expired http-response add-header X-SSL Expired if cert_expired

19
src/ssl_sample.c
View File

@ -398,6 +398,24 @@ static int sample_conv_crypto_digest(const struct arg *args, struct sample *smp,
return 1; return 1;
} }
/* Take a numerical X509_V_ERR and return its constant name */
static int sample_conv_x509_v_err(const struct arg *arg_p, struct sample *smp, void *private)
{
const char *res = x509_v_err_int_to_str(smp->data.u.sint);
/* if the value was found return its string */
if (res) {
smp->data.u.str.area = (char *)res;
smp->data.u.str.data = strlen(res);
smp->data.type = SMP_T_STR;
smp->flags |= SMP_F_CONST;
return 1;
}
return 0;
}
static int check_crypto_hmac(struct arg *args, struct sample_conv *conv, static int check_crypto_hmac(struct arg *args, struct sample_conv *conv,
const char *file, int line, char **err) const char *file, int line, char **err)
{ {
@ -2199,6 +2217,7 @@ static struct sample_conv_kw_list sample_conv_kws = {ILH, {
#ifdef EVP_CIPH_GCM_MODE #ifdef EVP_CIPH_GCM_MODE
{ "aes_gcm_dec", sample_conv_aes_gcm_dec, ARG4(4,SINT,STR,STR,STR), check_aes_gcm, SMP_T_BIN, SMP_T_BIN }, { "aes_gcm_dec", sample_conv_aes_gcm_dec, ARG4(4,SINT,STR,STR,STR), check_aes_gcm, SMP_T_BIN, SMP_T_BIN },
#endif #endif
{ "x509_v_err_str", sample_conv_x509_v_err, 0, NULL, SMP_T_SINT, SMP_T_STR },
{ "digest", sample_conv_crypto_digest, ARG1(1,STR), check_crypto_digest, SMP_T_BIN, SMP_T_BIN }, { "digest", sample_conv_crypto_digest, ARG1(1,STR), check_crypto_digest, SMP_T_BIN, SMP_T_BIN },
{ "hmac", sample_conv_crypto_hmac, ARG2(2,STR,STR), check_crypto_hmac, SMP_T_BIN, SMP_T_BIN }, { "hmac", sample_conv_crypto_hmac, ARG2(2,STR,STR), check_crypto_hmac, SMP_T_BIN, SMP_T_BIN },
#if defined(HAVE_CRYPTO_memcmp) #if defined(HAVE_CRYPTO_memcmp)