From 07a6d11b9c10a28fdfc7a1fbe2d16d6ad44d9fdc Mon Sep 17 00:00:00 2001 From: Emmanuel Hocdet Date: Thu, 2 Nov 2017 14:05:23 +0100 Subject: [PATCH 3/5] MINOR: ssl: add ssl_sock_get_cert_sig function ssl_sock_get_cert_sig can be used to report cert signature short name to log and ppv2 (RSA-SHA256). --- include/proto/ssl_sock.h | 1 + src/ssl_sock.c | 15 +++++++++++++++ 2 files changed, 16 insertions(+) diff --git a/include/proto/ssl_sock.h b/include/proto/ssl_sock.h index 6a268e969..e1d76a6a0 100644 --- a/include/proto/ssl_sock.h +++ b/include/proto/ssl_sock.h @@ -50,6 +50,7 @@ void ssl_sock_free_srv_ctx(struct server *srv); void ssl_sock_free_all_ctx(struct bind_conf *bind_conf); int ssl_sock_load_ca(struct bind_conf *bind_conf); void ssl_sock_free_ca(struct bind_conf *bind_conf); +const char *ssl_sock_get_cert_sig(struct connection *conn); const char *ssl_sock_get_cipher_name(struct connection *conn); const char *ssl_sock_get_proto_version(struct connection *conn); void ssl_sock_set_servername(struct connection *conn, const char *hostname); diff --git a/src/ssl_sock.c b/src/ssl_sock.c index c66ab7467..50c9b3200 100644 --- a/src/ssl_sock.c +++ b/src/ssl_sock.c @@ -5748,6 +5748,21 @@ int ssl_sock_get_pkey_algo(struct connection *conn, struct chunk *out) return 1; } +/* used for ppv2 cert signature (can be used for logging) */ +const char *ssl_sock_get_cert_sig(struct connection *conn) +{ + __OPENSSL_110_CONST__ ASN1_OBJECT *algorithm; + X509 *crt; + + if (!ssl_sock_is_ssl(conn)) + return NULL; + crt = SSL_get_certificate(conn->xprt_ctx); + if (!crt) + return NULL; + X509_ALGOR_get0(&algorithm, NULL, NULL, X509_get0_tbs_sigalg(crt)); + return OBJ_nid2sn(OBJ_obj2nid(algorithm)); +} + /* used for logging/ppv2, may be changed for a sample fetch later */ const char *ssl_sock_get_cipher_name(struct connection *conn) { -- 2.11.0