Function shadow_cert_generator

plugins/certifier/certifier.cc:397–522

}

static int
shadow_cert_generator(TSCont contp, TSEvent /* event ATS_UNUSED */, void * /* edata ATS_UNUSED */)
{
  const char *servername = reinterpret_cast<const char *>(TSContDataGet(contp));
  std::string commonName(servername);

  std::queue<void *> localQ;
  SSL_CTX           *ref_ctx;
  scoped_SSL_CTX     ctx;
  scoped_X509_REQ    req;
  scoped_X509        cert;

  /// Calculate hash and path, try certs on disk first
  unsigned char digest[MD5_DIGEST_LENGTH];
  MD5(reinterpret_cast<unsigned char const *>(commonName.data()), commonName.length(), digest);
  char md5String[5];
  snprintf(md5String, sizeof(md5String), "%02hhx%02hhx", digest[0], digest[1]);
  std::string path          = store_path + "/" + std::string(md5String, 3);
  std::string cert_filename = path + '/' + commonName + ".crt";

  struct stat st;
  FILE       *fp = nullptr;
  /// If directory doesn't exist, create one
  if (stat(path.c_str(), &st) == -1) {
    mkdir(path.c_str(), 0755);
  } else {
    /// Try open the file if directory exists
    fp = fopen(cert_filename.c_str(), "rt");
  }
  Dbg(dbg_ctl, "%s: cert file is expected at %s", __func__, cert_filename.c_str());
  /// If cert file exists and is readable
  if (fp != nullptr) {
    cert.reset(PEM_read_X509(fp, nullptr, nullptr, nullptr));
    fclose(fp);

    if (cert == nullptr) {
      /// Problem with cert file / openssl read
      TSError("[%s] %s: failed o load certificate from '%s'", PLUGIN_NAME, __func__, cert_filename.c_str());
    } else {
      Dbg(dbg_ctl, "%s: loaded certificate from '%s'", __func__, cert_filename.c_str());
    }
  }

  /// No valid certs available from disk, create one and write to file
  if (cert == nullptr) {
    if (!sign_enabled) {
      Dbg(dbg_ctl, "%s: no certs found and dynamic generation disabled; marked as wontdo", __func__);
      // There won't be certs available. Mark this servername as wontdo
      // Pass on as if plugin doesn't exist
      ssl_list->setup_data_ctx(commonName, localQ, nullptr, nullptr, true);
      while (!localQ.empty()) {
        // Dbg(dbg_ctl, "\tClearing the queue size %lu", localQ.size());
        TSVConn ssl_vc = reinterpret_cast<TSVConn>(localQ.front());
        localQ.pop();
        TSVConnReenable(ssl_vc);
      }
      TSContDestroy(contp);
      return TS_SUCCESS;