Skip to content

Added SSL related fields to access.log #122

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
acaciocenteno wants to merge 1 commit into from
Closed

Added SSL related fields to access.log #122

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 22 additions & 0 deletions iocore/net/P_SSLNetVConnection.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -120,6 +120,28 @@ class SSLNetVConnection:public UnixNetVConnection
sslClientRenegotiationAbort = state;
};

const char * get_ssl_protocol(void) const
{
if ( ssl == NULL )
return NULL;
return SSL_get_cipher_version(ssl);
Copy link
Copy Markdown
Contributor

@bellofreedom bellofreedom Oct 16, 2014

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This would return cipher's version like TLSv1/SSLv3 or SSLv2. For SSL protocol version , I think it would be better to use SSL_get_version.

Copy link
Copy Markdown
Member

@shinrich shinrich Jul 13, 2015

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Agreed, SSL_get_version is probably what you want here.

};

const char * get_ssl_cipher_suite(void) const
{
if ( ssl == NULL )
return NULL;
return SSL_get_cipher_name(ssl);
}

bool get_ssl_session_reused(void) const
{
if ( ssl == NULL )
return false;
return SSL_session_reused(ssl);
}


private:
SSLNetVConnection(const SSLNetVConnection &);
SSLNetVConnection & operator =(const SSLNetVConnection &);
Expand Down
2 changes: 1 addition & 1 deletion iocore/net/SSLNetVConnection.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -793,4 +793,4 @@ SSLNetVConnection::select_next_protocol(SSL * ssl, const unsigned char ** out, u
*out = NULL;
*outlen = 0;
return SSL_TLSEXT_ERR_NOACK;
}
}
39 changes: 37 additions & 2 deletions proxy/http/HttpSM.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -327,7 +327,8 @@ HttpSM::HttpSM()
pushed_response_hdr_bytes(0), pushed_response_body_bytes(0),
plugin_tag(0), plugin_id(0),
hooks_set(false), cur_hook_id(TS_HTTP_LAST_HOOK), cur_hook(NULL),
cur_hooks(0), callout_state(HTTP_API_NO_CALLOUT), terminate_sm(false), kill_this_async_done(false)
cur_hooks(0), callout_state(HTTP_API_NO_CALLOUT), terminate_sm(false), kill_this_async_done(false),
sec_protocol("-"), sec_cipher_suite("-"), sec_session_reused(false)
{
static int scatter_init = 0;

Expand Down Expand Up @@ -428,7 +429,6 @@ HttpSM::init()
debug_sm_list.push(this, this->debug_link);
ink_mutex_release(&debug_sm_list_mutex);
#endif

}

void
Expand Down Expand Up @@ -588,6 +588,8 @@ HttpSM::attach_client_session(HttpClientSession * client_vc, IOBufferReader * bu
--reentrancy_count;
ink_assert(reentrancy_count >= 0);
}

setup_security_properties();
}


Expand Down Expand Up @@ -7673,3 +7675,36 @@ HttpSM::is_redirect_required()
}
return redirect_required;
}

inline void
HttpSM::setup_security_properties(void)
{
ink_assert(ua_session != NULL);

SSLNetVConnection *ssl_vc = dynamic_cast<SSLNetVConnection *>(ua_session->get_netvc());

if (ssl_vc != NULL) {
sec_protocol = ssl_vc->get_ssl_protocol();
sec_cipher_suite = ssl_vc->get_ssl_cipher_suite();
sec_session_reused = ssl_vc->get_ssl_session_reused();
}
}

const char *
HttpSM::get_security_protocol(void)
{
return sec_protocol;
}


const char *
HttpSM::get_security_cipher_suite(void)
{
return sec_cipher_suite;
}

bool
HttpSM::get_security_session_reused(void)
{
return sec_session_reused;
}
13 changes: 13 additions & 0 deletions proxy/http/HttpSM.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -532,6 +532,19 @@ class HttpSM: public Continuation

public:
bool set_server_session_private(bool private_session);

// Info about client's SSL connection.
private:
const char * sec_protocol;
const char * sec_cipher_suite;
bool sec_session_reused;

inline void setup_security_properties(void);

public:
const char * get_security_protocol(void);
const char * get_security_cipher_suite(void);
bool get_security_session_reused(void);
};

//Function to get the cache_sm object - YTS Team, yamsat
Expand Down
21 changes: 21 additions & 0 deletions proxy/logging/Log.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -877,6 +877,27 @@ Log::init_fields()
global_field_list.add(field, false);
ink_hash_table_insert(field_symbol_hash, "etype", field);

field = new LogField("client_sec_protocol", "csp",
LogField::STRING,
&LogAccess::marshal_client_security_protocol,
(LogField::UnmarshalFunc)&LogAccess::unmarshal_str);
global_field_list.add(field, false);
ink_hash_table_insert(field_symbol_hash, "csp", field);

field = new LogField("client_sec_cipher_suite", "csc",
LogField::STRING,
&LogAccess::marshal_client_security_cipher_suite,
(LogField::UnmarshalFunc)&LogAccess::unmarshal_str);
global_field_list.add(field, false);
ink_hash_table_insert(field_symbol_hash, "csc", field);

field = new LogField("client_sec_session_reused", "cssr",
LogField::STRING,
&LogAccess::marshal_client_security_session_reused,
(LogField::UnmarshalFunc)&LogAccess::unmarshal_str);
global_field_list.add(field, false);
ink_hash_table_insert(field_symbol_hash, "cssr", field);

init_status |= FIELDS_INITIALIZED;
}

Expand Down
20 changes: 20 additions & 0 deletions proxy/logging/LogAccess.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -234,6 +234,26 @@ LogAccess::marshal_client_finish_status_code(char *buf)
DEFAULT_INT_FIELD;
}

/*-------------------------------------------------------------------------
-------------------------------------------------------------------------*/
int
LogAccess::marshal_client_security_protocol(char *buf)
{
DEFAULT_STR_FIELD;
}

int
LogAccess::marshal_client_security_cipher_suite(char *buf)
{
DEFAULT_STR_FIELD;
}

int
LogAccess::marshal_client_security_session_reused(char *buf)
{
DEFAULT_STR_FIELD;
}

/*-------------------------------------------------------------------------
-------------------------------------------------------------------------*/

Expand Down
3 changes: 3 additions & 0 deletions proxy/logging/LogAccess.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -185,6 +185,9 @@ class LogAccess
inkcoreapi virtual int marshal_client_req_header_len(char *); // INT
inkcoreapi virtual int marshal_client_req_body_len(char *); // INT
inkcoreapi virtual int marshal_client_finish_status_code(char *); // INT
inkcoreapi virtual int marshal_client_security_protocol(char *); // STR
inkcoreapi virtual int marshal_client_security_cipher_suite(char *); // STR
inkcoreapi virtual int marshal_client_security_session_reused(char *); // STR

//
// proxy -> client fields
Expand Down
38 changes: 38 additions & 0 deletions proxy/logging/LogAccessHttp.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -583,6 +583,44 @@ LogAccessHttp::marshal_client_finish_status_code(char *buf)
return INK_MIN_ALIGN;
}

/*-------------------------------------------------------------------------
-------------------------------------------------------------------------*/
int
LogAccessHttp::marshal_client_security_protocol(char *buf)
{
const char * proto = m_http_sm->get_security_protocol();
int round_len = LogAccess::strlen(proto);
if (buf) {
marshal_str(buf, proto, round_len);
}
return round_len;
}

int
LogAccessHttp::marshal_client_security_cipher_suite(char *buf)
{
const char * cipher = m_http_sm->get_security_cipher_suite();
int round_len = LogAccess::strlen(cipher);
if (buf) {
marshal_str(buf, cipher, round_len);
}
return round_len;
}

int
LogAccessHttp::marshal_client_security_session_reused(char *buf)
{

bool reused = m_http_sm->get_security_session_reused();
const char * out = (reused) ? "r" : "-";
int round_len = LogAccess::strlen(out);
if (buf) {
marshal_str(buf, out, round_len);
}
return round_len;
}


/*-------------------------------------------------------------------------
-------------------------------------------------------------------------*/

Expand Down
3 changes: 3 additions & 0 deletions proxy/logging/LogAccessHttp.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,6 +71,9 @@ class LogAccessHttp:public LogAccess
virtual int marshal_client_req_header_len(char *); // INT
virtual int marshal_client_req_body_len(char *); // INT
virtual int marshal_client_finish_status_code(char *); // INT
virtual int marshal_client_security_protocol(char *); // STR
virtual int marshal_client_security_cipher_suite(char *); // STR
virtual int marshal_client_security_session_reused(char *); // STR

//
// proxy -> client fields
Expand Down