RepoMirrors/haproxy
1
0
Fork 0
mirror of http://git.haproxy.org/git/haproxy.git/ synced 2025-01-22 05:22:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

MINOR: ssl: rework smp_fetch_ssl_fc_cl_str without internal ssl use

Browse Source 
smp_fetch_ssl_fc_cl_str as very limited usage (only work with openssl == 1.0.2
compiled with the option enable-ssl-trace). It use internal cipher.algorithm_ssl
attribut and SSL_CIPHER_standard_name (available with ssl-trace).
This patch implement this (debug) function in a standard way. It used common
SSL_CIPHER_get_name to display cipher name. It work with openssl >= 1.0.2
and boringssl.
This commit is contained in:
Emmanuel Hocdet 2017-09-01 17:32:08 +02:00 committed by Willy Tarreau
parent 3d609a755e
commit ddcde195eb
3 changed files with 16 additions and 26 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
doc/configuration.txt
View File

@ -14173,9 +14173,8 @@ ssl_fc_cipherlist_str : string
Returns the decoded text form of the client hello cipher list. The maximum Returns the decoded text form of the client hello cipher list. The maximum
number of ciphers returned is according with the value of number of ciphers returned is according with the value of
"tune.ssl.capture-cipherlist-size". Note that this sample-fetch is only "tune.ssl.capture-cipherlist-size". Note that this sample-fetch is only
avaible with OpenSSL > 1.0.2 compiled with the option enable-ssl-trace. avaible with OpenSSL >= 1.0.2. If the function is not enabled, this
If the function is not enabled, this sample-fetch returns the hash sample-fetch returns the hash like "ssl_fc_cipherlist_xxh".
like "ssl_fc_cipherlist_xxh".
ssl_fc_cipherlist_xxh : integer ssl_fc_cipherlist_xxh : integer
Returns a xxh64 of the cipher list. This hash can be return only is the value Returns a xxh64 of the cipher list. This hash can be return only is the value

5
include/proto/openssl-compat.h
View File

@ -152,11 +152,6 @@ static inline X509_ALGOR *X509_get0_tbs_sigalg(const X509 *x)
#define __OPENSSL_110_CONST__ #define __OPENSSL_110_CONST__
#endif #endif
#if defined(OPENSSL_IS_BORINGSSL) || defined(LIBRESSL_VERSION_NUMBER)
#undef OPENSSL_NO_SSL_TRACE
#define OPENSSL_NO_SSL_TRACE
#endif
#ifdef OPENSSL_IS_BORINGSSL #ifdef OPENSSL_IS_BORINGSSL
#define SSL_NO_GENERATE_CERTIFICATES #define SSL_NO_GENERATE_CERTIFICATES

32
src/ssl_sock.c
View File

@ -6308,32 +6308,28 @@ smp_fetch_ssl_fc_cl_xxh64(const struct arg *args, struct sample *smp, const char
static int static int
smp_fetch_ssl_fc_cl_str(const struct arg *args, struct sample *smp, const char *kw, void *private) smp_fetch_ssl_fc_cl_str(const struct arg *args, struct sample *smp, const char *kw, void *private)
{ {
#if (OPENSSL_VERSION_NUMBER >= 0x1000200fL) && !defined(OPENSSL_NO_SSL_TRACE) #if (OPENSSL_VERSION_NUMBER >= 0x1000200fL) && !defined(LIBRESSL_VERSION_NUMBER)
struct chunk *data; struct chunk *data;
SSL_CIPHER cipher;
int i; int i;
const char *str;
unsigned char *bin;
if (!smp_fetch_ssl_fc_cl_bin(args, smp, kw, private)) if (!smp_fetch_ssl_fc_cl_bin(args, smp, kw, private))
return 0; return 0;
/* The cipher algorith must not be SSL_SSLV2, because this
* SSL version seems to not have the same cipher encoding,
* and it is not supported by OpenSSL. Unfortunately, the
* #define SSL_SSLV2, SSL_SSLV3 and others are not available
* with standard defines. We just set the variable to 0,
* ensure that the match with SSL_SSLV2 fails.
*/
cipher.algorithm_ssl = 0;
data = get_trash_chunk(); data = get_trash_chunk();
for (i = 0; i + 1 < smp->data.u.str.len; i += 2) { for (i = 0; i + 1 < smp->data.u.str.len; i += 2) {
bin = (unsigned char *)smp->data.u.str.str + i; const char *str;
cipher.id = (unsigned int)(bin[0] << 8) | bin[1]; const SSL_CIPHER *cipher;
str = SSL_CIPHER_standard_name(&cipher); const unsigned char *bin = (const unsigned char *)smp->data.u.str.str + i;
if (!str || strcmp(str, "UNKNOWN") == 0) uint16_t id = (bin[0] << 8) | bin[1];
chunk_appendf(data, "%sUNKNOWN(%04x)", i == 0 ? "" : ",", (unsigned int)cipher.id); #if defined(OPENSSL_IS_BORINGSSL)
cipher = SSL_get_cipher_by_value(id);
#else
struct connection *conn = objt_conn(smp->sess->origin);
cipher = SSL_CIPHER_find(conn->xprt_ctx, bin);
#endif
str = SSL_CIPHER_get_name(cipher);
if (!str || strcmp(str, "(NONE)") == 0)
chunk_appendf(data, "%sUNKNOWN(%04x)", i == 0 ? "" : ",", id);
else else
chunk_appendf(data, "%s%s", i == 0 ? "" : ",", str); chunk_appendf(data, "%s%s", i == 0 ? "" : ",", str);
} }