diff options
author | Jan Tattermusch <jtattermusch@users.noreply.github.com> | 2016-03-18 14:02:39 -0700 |
---|---|---|
committer | Jan Tattermusch <jtattermusch@users.noreply.github.com> | 2016-03-18 14:02:39 -0700 |
commit | ee69f425525b27cc59ef7d67f47699d1f177bae5 (patch) | |
tree | e65468605a9ef4c3b533c301c43e0c27c583fc60 /src | |
parent | 79787471985c8b1403b82a3f3df225496c0fd7e1 (diff) | |
parent | e61cbe3fd3b382d963f63c078bb8bf6e323de05c (diff) |
Merge pull request #5706 from deepaklukose/dev
Expose pem cert in AuthContext for SSL/TLS channels
Diffstat (limited to 'src')
-rw-r--r-- | src/core/security/security_connector.c | 16 | ||||
-rw-r--r-- | src/core/tsi/ssl_transport_security.c | 27 | ||||
-rw-r--r-- | src/core/tsi/ssl_transport_security.h | 2 |
3 files changed, 39 insertions, 6 deletions
diff --git a/src/core/security/security_connector.c b/src/core/security/security_connector.c index 33c62a20c2..fbec263eed 100644 --- a/src/core/security/security_connector.c +++ b/src/core/security/security_connector.c @@ -492,6 +492,9 @@ grpc_auth_context *tsi_ssl_peer_to_auth_context(const tsi_peer *peer) { peer_identity_property_name = GRPC_X509_SAN_PROPERTY_NAME; grpc_auth_context_add_property(ctx, GRPC_X509_SAN_PROPERTY_NAME, prop->value.data, prop->value.length); + } else if (strcmp(prop->name, TSI_X509_PEM_CERT_PROPERTY) == 0) { + grpc_auth_context_add_property(ctx, GRPC_X509_PEM_CERT_PROPERTY_NAME, + prop->value.data, prop->value.length); } } if (peer_identity_property_name != NULL) { @@ -554,9 +557,9 @@ static void ssl_server_check_peer(grpc_exec_ctx *exec_ctx, grpc_auth_context_unref(auth_context); } -static void add_shalow_auth_property_to_peer(tsi_peer *peer, - const grpc_auth_property *prop, - const char *tsi_prop_name) { +static void add_shallow_auth_property_to_peer(tsi_peer *peer, + const grpc_auth_property *prop, + const char *tsi_prop_name) { tsi_peer_property *tsi_prop = &peer->properties[peer->property_count++]; tsi_prop->name = (char *)tsi_prop_name; tsi_prop->value.data = prop->value; @@ -579,11 +582,14 @@ tsi_peer tsi_shallow_peer_from_ssl_auth_context( it = grpc_auth_context_property_iterator(auth_context); while ((prop = grpc_auth_property_iterator_next(&it)) != NULL) { if (strcmp(prop->name, GRPC_X509_SAN_PROPERTY_NAME) == 0) { - add_shalow_auth_property_to_peer( + add_shallow_auth_property_to_peer( &peer, prop, TSI_X509_SUBJECT_ALTERNATIVE_NAME_PEER_PROPERTY); } else if (strcmp(prop->name, GRPC_X509_CN_PROPERTY_NAME) == 0) { - add_shalow_auth_property_to_peer( + add_shallow_auth_property_to_peer( &peer, prop, TSI_X509_SUBJECT_COMMON_NAME_PEER_PROPERTY); + } else if (strcmp(prop->name, GRPC_X509_PEM_CERT_PROPERTY_NAME) == 0) { + add_shallow_auth_property_to_peer(&peer, prop, + TSI_X509_PEM_CERT_PROPERTY); } } } diff --git a/src/core/tsi/ssl_transport_security.c b/src/core/tsi/ssl_transport_security.c index fcbd910f07..42d25ca929 100644 --- a/src/core/tsi/ssl_transport_security.c +++ b/src/core/tsi/ssl_transport_security.c @@ -293,6 +293,26 @@ static tsi_result peer_property_from_x509_common_name( return result; } +/* Gets the X509 cert in PEM format as a tsi_peer_property. */ +static tsi_result add_pem_certificate(X509 *cert, tsi_peer_property *property) { + BIO *bio = BIO_new(BIO_s_mem()); + if (!PEM_write_bio_X509(bio, cert)) { + BIO_free(bio); + return TSI_INTERNAL_ERROR; + } + char *contents; + long len = BIO_get_mem_data(bio, &contents); + if (len <= 0) { + BIO_free(bio); + return TSI_INTERNAL_ERROR; + } + tsi_result result = tsi_construct_string_peer_property( + TSI_X509_PEM_CERT_PROPERTY, (const char *)contents, (size_t)len, + property); + BIO_free(bio); + return result; +} + /* Gets the subject SANs from an X509 cert as a tsi_peer_property. */ static tsi_result add_subject_alt_names_properties_to_peer( tsi_peer *peer, GENERAL_NAMES *subject_alt_names, @@ -363,7 +383,8 @@ static tsi_result peer_from_x509(X509 *cert, int include_certificate_type, tsi_result result; GPR_ASSERT(subject_alt_name_count >= 0); property_count = (include_certificate_type ? (size_t)1 : 0) + - 1 /* common name */ + (size_t)subject_alt_name_count; + 2 /* common name, certificate */ + + (size_t)subject_alt_name_count; result = tsi_construct_peer(property_count, peer); if (result != TSI_OK) return result; do { @@ -377,6 +398,10 @@ static tsi_result peer_from_x509(X509 *cert, int include_certificate_type, cert, &peer->properties[include_certificate_type ? 1 : 0]); if (result != TSI_OK) break; + result = add_pem_certificate( + cert, &peer->properties[include_certificate_type ? 2 : 1]); + if (result != TSI_OK) break; + if (subject_alt_name_count != 0) { result = add_subject_alt_names_properties_to_peer( peer, subject_alt_names, (size_t)subject_alt_name_count); diff --git a/src/core/tsi/ssl_transport_security.h b/src/core/tsi/ssl_transport_security.h index 4909af4c47..32bb067f0b 100644 --- a/src/core/tsi/ssl_transport_security.h +++ b/src/core/tsi/ssl_transport_security.h @@ -48,6 +48,8 @@ extern "C" { #define TSI_X509_SUBJECT_ALTERNATIVE_NAME_PEER_PROPERTY \ "x509_subject_alternative_name" +#define TSI_X509_PEM_CERT_PROPERTY "x509_pem_cert" + #define TSI_SSL_ALPN_SELECTED_PROTOCOL "ssl_alpn_selected_protocol" /* --- tsi_ssl_handshaker_factory object --- |