Add a const getter for X509 used in handshake (server-side)

Summary:
Similar to other getters such as getSSLCertSize, but returns a const X509*.
This may be useful to get cert parameters after handshake is complete
(or in error).

Reviewed By: yfeldblum

Differential Revision: D3636598

fbshipit-source-id: 98f0e2987de53d6343541ef0ed588f9ad18390cd

diff --git a/folly/io/async/AsyncSSLSocket.cpp b/folly/io/async/AsyncSSLSocket.cpp
index 572d8800a330ceb0449afb76dab6af395321ea7e..a326ca5c1f6e0145060c55f64485ceb6f458a131 100644 (file)
--- a/folly/io/async/AsyncSSLSocket.cpp
+++ b/folly/io/async/AsyncSSLSocket.cpp
@@ -880,6 +880,10 @@ int AsyncSSLSocket::getSSLCertSize() const {
   return certSize;
 }
 
+const X509* AsyncSSLSocket::getSelfCert() const {
+  return (ssl_ != nullptr) ? SSL_get_certificate(ssl_) : nullptr;
+}
+
 bool AsyncSSLSocket::willBlock(int ret,
                                int* sslErrorOut,
                                unsigned long* errErrorOut) noexcept {

diff --git a/folly/io/async/AsyncSSLSocket.h b/folly/io/async/AsyncSSLSocket.h
index eb6251c71eee087b4c156dc1680892db51b71e86..0efd73bdc9f9b31b8742cef54a95fdc911c90267 100644 (file)
--- a/folly/io/async/AsyncSSLSocket.h
+++ b/folly/io/async/AsyncSSLSocket.h
@@ -457,6 +457,11 @@ class AsyncSSLSocket : public virtual AsyncSocket {
    */
   int getSSLCertSize() const;
 
+  /**
+   * Get the certificate used for this SSL connection. May be null
+   */
+  virtual const X509* getSelfCert() const override;
+
   virtual void attachEventBase(EventBase* eventBase) override {
     AsyncSocket::attachEventBase(eventBase);
     handshakeTimeout_.attachEventBase(eventBase);

diff --git a/folly/io/async/AsyncTransport.h b/folly/io/async/AsyncTransport.h
index d421bb6be95709763cea7d46aa89779934b40304..632a782b5f09c3a9a7c082fdbd427a61d50c9241 100644 (file)
--- a/folly/io/async/AsyncTransport.h
+++ b/folly/io/async/AsyncTransport.h
@@ -326,6 +326,13 @@ class AsyncTransport : public DelayedDestruction, public AsyncSocketBase {
    */
   virtual ssl::X509UniquePtr getPeerCert() const { return nullptr; }
 
+  /**
+   * The local certificate used for this connection. May be null
+   */
+  virtual const X509* getSelfCert() const {
+    return nullptr;
+  }
+
   /**
    * @return True iff end of record tracking is enabled
    */