Skip to content

Add a getter to allow access to the gnutls_session_t.#233

Merged
etr merged 6 commits intoetr:masterfrom
bcsgh:bcs-add-tls.get_tls_session
Jun 9, 2021
Merged

Add a getter to allow access to the gnutls_session_t.#233
etr merged 6 commits intoetr:masterfrom
bcsgh:bcs-add-tls.get_tls_session

Conversation

@bcsgh
Copy link
Copy Markdown
Contributor

@bcsgh bcsgh commented May 18, 2021

Description of the Change

Add a method to yield a handle to the TLS sessions being used by libmicrohttpd for the request,

Alternate Designs

I considered building API's the provide C++ wrappers for the specific TLS API's that would be needed but concluded that is not the job of this library.

Possible Drawbacks

Verification Process

I ran a server using the new method to log data about the session.

class hello_world_resource : public httpserver::http_resource {
 public:
  const std::shared_ptr<httpserver::http_response> render(const httpserver::http_request&) override {
    auto tls = req.get_tls_session();
    LOG(INFO) << "Verion: " << gnutls_protocol_get_name(gnutls_protocol_get_version(tls));
    auto type = gnutls_certificate_type_get(tls);
    LOG(INFO) << "CertType: " << gnutls_certificate_type_get_name(type);
    unsigned int cert_count;
    auto* certs = gnutls_certificate_get_peers(tls, &cert_count);
    LOG(INFO) << "CertCount(Client): " << cert_count;
    // etc ...
  }
};

....

httpserver::webserver ws = httpserver::create_webserver(port)
            .debug()
            .log_error(+[](const std::string& err){
              std::cout << err << std::endl;
            })
            .use_ssl()
            .raw_https_mem_key(std::string{tls_server_self_signed_cert_key_pem()})
            .raw_https_mem_cert(std::string{tls_server_self_signed_cert_pem()})
            .start_method(httpserver::http::http_utils::INTERNAL_SELECT)
            .max_threads(5);

hello_world_resource hwr;
ws.register_resource("/hello", &hwr, true);
ws.start(true);

And got:

I20210517 20:59:25.343529 20745 server.cc:74] Verion: TLS1.2
I20210517 20:59:25.343542 20745 server.cc:77] CertType: X.509
I20210517 20:59:25.343555 20745 server.cc:81] CertCount(Client): 0

(This is a brand new API, with exactly 2 lines of non-declaration and no flow control. It's either works or it doesn't.)

Release Notes

Add httpserver::http_request::get_tls_session() to allow access to full TLS session.

@bcsgh
Copy link
Copy Markdown
Contributor Author

bcsgh commented May 18, 2021

FWIW: this reason I want this is to allow access to play around with client side cert based authentication.

@etr
Copy link
Copy Markdown
Owner

etr commented Jun 9, 2021

Hey, thanks for the change (and sorry for the delay on this answer). It looks good to me overall. Do you mind adding info into the documentation (the README.md) to make it discoverable? (there is a section dedicated to http_request)

@bcsgh
Copy link
Copy Markdown
Contributor Author

bcsgh commented Jun 9, 2021

Done. And while looking at it, I realized there is no easy/safe way to call that method so I added a predicate for checking that.

Copy link
Copy Markdown
Owner

@etr etr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we fix a typo in the documentation - with that done, I can merge

@etr etr merged commit c5cf5ea into etr:master Jun 9, 2021
@etr
Copy link
Copy Markdown
Owner

etr commented Jun 9, 2021

Looks good, thanks for the support

@bcsgh bcsgh deleted the bcs-add-tls.get_tls_session branch April 11, 2023 02:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants