Re: [RFC] Certificate validation helper

From: Alex Rousskov <rousskov_at_measurement-factory.com>
Date: Tue, 03 Jul 2012 19:07:38 -0600

On 07/03/2012 06:54 PM, Amos Jeffries wrote:
> On 04.07.2012 12:11, Alex Rousskov wrote:
>> On 07/03/2012 04:56 PM, Amos Jeffries wrote:
>>> On 03.07.2012 14:59, Alex Rousskov wrote:
>>>> On 07/02/2012 06:20 PM, Amos Jeffries wrote:
>>>>>
>>>>> I am in the process of modifying the helper API for consistency across
>>>>> all helpers starting with 3.3. It would be great if you could design
>>>>> your helper to use a generic output format for data sent back to
>>>>> Squid:
>>>>>
>>>>> [channel-ID] (OK/ERR/BH) [key-pairs] <terminator>
>>>>
>>>> OK, but not all helper communication is line-based. We may need to send
>>>> PEM-encoded certificates back (and ssl_crtd already does that). That
>>>> requires sending multiline blocks of data.
>>>>
>>>> If you want to generalize that, consider adding body start/end
>>>> terminators.
>>>
>>> I know. That is why I omit the word "line" and specify <terminator>
>>> instead of <EOL>.
>>
>>
>> The proposed format is missing the body itself, unless you want to force
>> all helpers to use key=value format for blobs such as PEM-encoded
>> certificates.
>
> Oops. yes. The HelperReply object has to include a field <blob> of type
> char* specific to each helper (for certs and bodies blobs, messages,
> etc.) which includes everything between the first undentifiable key-pair
> and the terminator. It is required for backward compatibility even if I
> was set on key-pair always. So it may as well be formalised.

Why should the body include key-value pairs?

> [channel-ID] (OK/ERR/BH) [key-pairs] <blob> <terminator>

How will the generic code be able to tell where key-pairs end and blob
begins?

>> Ideally, there will be a way for generic helper parsers to
>> detect and extract the body. To reach that ideal, there should be a
>> common format that includes the body.
>>
>
> Yes.
>
> Pedant: There are only 2 helpers out of 14 that send certificate bodies.
> This new one and ssl_crtd. Why define a "body" field just for them?

It is certainly not needed if you do not want to have one parser/format
for all helpers. We can continue to craft custom code for each new
helper that needs to send bodies if you think that is the best approach.

> With [key-pair] before any helper-specific <blob>, we can add a key-pair
> "cert=<foo>" for generic certificate passing around if/when necessary.

This approach does not work well because <foo> may include spaces/'='
and, hence, be confused with more key-pairs.

If you want one format for all, you probably need something like

 [channel-ID] (OK/ERR/BH) [key-pairs] [BS <body>] <terminator>

where "BS" is some special marker that starts all bodies and cannot be
found in key-pairs. Since any body-carrying message is likely to have
new lines (and, hence, would need a non-newline terminator), this BS
sequence could be something like "body:\n", I guess.

Thank you,

Alex.
Received on Wed Jul 04 2012 - 01:07:41 MDT

This archive was generated by hypermail 2.2.0 : Wed Jul 04 2012 - 12:00:03 MDT