Merge branch 'ingela/master/inets/http_server-ssl-peer-cert/OTP-13510'

* ingela/master/inets/http_server-ssl-peer-cert/OTP-13510:
  inets: Add peer_cert to ESI environment

4 files changed, 98 insertions, 14 deletions

diff --git a/lib/inets/doc/src/mod_esi.xml b/lib/inets/doc/src/mod_esi.xml
index ae567ea185..deef010e54 100644
--- a/lib/inets/doc/src/mod_esi.xml
+++ b/lib/inets/doc/src/mod_esi.xml
@@ -23,10 +23,6 @@
     </legalnotice>
 
     <title>mod_esi</title>
-    <prepared>Joakim Greben&ouml;</prepared>
-    <docno></docno>
-    <date>1997-10-14</date>
-    <rev>2.2</rev>
     <file>mod_esi.sgml</file>
   </header>
   <module>mod_esi</module>
@@ -39,6 +35,56 @@
     <marker id="deliver"></marker>
   </description>
 
+ <section>
+    <title>DATA TYPES</title>
+    <p>The following data types are used in the functions for mod_esi:</p>
+
+    <taglist>
+      <tag><c>env() = </c></tag>
+      <item> <p><c>{EnvKey()::atom(), Value::term()}</c></p>
+      </item>
+      
+      <p>Currently supported key value pairs</p>
+      <taglist>		
+	
+	<tag><c>{server_software, string()}</c></tag>
+	<item><p>Indicates the inets version.</p></item>
+	
+	<tag><c>{server_name, string()}</c></tag>
+	<item><p>The local hostname. </p></item>
+
+	<tag><c>{gateway_interface, string()}</c></tag>
+	<item><p>Legacy string used in CGI, just ignore.</p> </item>
+	
+	<tag><c>{server_protocol, string()}</c></tag>
+	<item><p> HTTP version, currently "HTTP/1.1"</p></item>
+	
+	<tag>{server_port, integer()}</tag>
+	<item><p>Servers port number.</p></item>
+	
+	<tag><c>{request_method, "GET | "PUT" | "DELETE | "POST" | "PATCH"}</c></tag>
+	
+	<tag><c>{remote_adress, inet:ip_address()} </c></tag>
+	<item><p>The clients ip address.</p></item>
+
+	<tag><c>{peer_cert, undefined | no_peercert | DER:binary()</c></tag>
+	<item>
+	  <p>For TLS connections where client certificates are used this will
+	  be an ASN.1 DER-encoded X509-certificate as an Erlang binary.
+	  If client certificates are not used the value will be <c>no_peercert</c>,
+	  and if TLS is not used (HTTP or connection is lost due to network failure)
+	  the value will be <c>undefined</c>.
+	</p></item>
+	
+	<tag><c>{script_name, string()}</c></tag>
+	<item><p>Request URI</p></item>
+
+	<tag><c>{http_LowerCaseHTTPHeaderName, string()}</c></tag>
+	<item><p>example: {http_content_type, "text/html"}</p></item>
+      </taglist>
+      
+    </taglist>
+
   <funcs>
     <func>
       <name>deliver(SessionID, Data) -> ok | {error, Reason}</name>
@@ -63,11 +109,11 @@
 	  overhead. Do not assume anything about the data type of 
 	  <c>SessionID</c>. <c>SessionID</c> must be the value given 
 	  as input to the ESI callback function that you implemented.</p>
-	</note>
+	  </note>
       </desc>
     </func>
   </funcs>
-
+  </section>
   <section>
     <title>ESI Callback Functions</title>
   </section>
@@ -78,9 +124,7 @@
       to the server process by calling <c>mod_esi:deliver/2</c>.</fsummary>
       <type>
         <v>SessionID = term()</v>
-        <v>Env = [EnvironmentDirectives] ++ ParsedHeader</v>
-        <v>EnvironmentDirectives = {Key,Value}</v>
-        <v>Key = query_string | content_length | server_software | gateway_interface | server_protocol | server_port | request_method | remote_addr | script_name</v>
+        <v>Env = env()</v>
         <v>Input = string()</v>
       </type>
       <desc>
@@ -111,9 +155,7 @@
       <fsummary>Creates a dynamic web page and returns it as a list. 
       This function is deprecated and is only kept for backwards compatibility.</fsummary>
       <type>
-        <v>Env = [EnvironmentDirectives] ++ ParsedHeader</v>
-        <v>EnvironmentDirectives = {Key,Value}</v>
-		  <v>Key = query_string | content_length | server_software | gateway_interface | server_protocol | server_port | request_method | remote_addr | script_name.</v>
+        <v>Env = env()</v>
         <v>Input = string()</v>
         <v>Response = string()</v>
       </type>
diff --git a/lib/inets/src/http_server/httpd_example.erl b/lib/inets/src/http_server/httpd_example.erl
index 366e37742b..424d269859 100644
--- a/lib/inets/src/http_server/httpd_example.erl
+++ b/lib/inets/src/http_server/httpd_example.erl
@@ -20,7 +20,7 @@
 %%
 -module(httpd_example).
 -export([print/1]).
--export([get/2, post/2, yahoo/2, test1/2, get_bin/2]).
+-export([get/2, post/2, yahoo/2, test1/2, get_bin/2, peer/2]).
 
 -export([newformat/3]).
 %% These are used by the inets test-suite
@@ -94,10 +94,26 @@ default(Env,Input) ->
    io_lib:format("~p",[httpd:parse_query(Input)]),"\n",
    footer()].
 
+peer(Env, Input) ->
+   Header = 
+     case proplists:get_value(peer_cert, Env) of
+       undefined ->
+   	 header("text/html", "Peer-Cert-Exist:false");
+      _ ->
+         header("text/html", "Peer-Cert-Exist:true")
+     end,
+   [Header,
+   top("Test peer_cert environment option"),
+   "<B>Peer cert:</B> ",
+   io_lib:format("~p",[proplists:get_value(peer_cert, Env)]),"\n",
+   footer()].	   	 
+
 header() ->
   header("text/html").
 header(MimeType) ->
   "Content-type: " ++ MimeType ++ "\r\n\r\n".
+header(MimeType, Other) ->
+  "Content-type: " ++ MimeType ++ "\r\n" ++ Other ++ "\r\n\r\n".			 
 
 top(Title) ->
   "<HTML>
diff --git a/lib/inets/src/http_server/httpd_script_env.erl b/lib/inets/src/http_server/httpd_script_env.erl
index 25f9bea7b3..e15613273e 100644
--- a/lib/inets/src/http_server/httpd_script_env.erl
+++ b/lib/inets/src/http_server/httpd_script_env.erl
@@ -61,6 +61,19 @@ which_port(#mod{config_db = ConfigDb}) ->
 which_peername(#mod{init_data = #init_data{peername = {_, RemoteAddr}}}) ->
     RemoteAddr.
 
+which_peercert(#mod{socket_type = {Type, _}, socket = Socket}) when Type == essl;
+								    Type == ssl ->
+    case ssl:peercert(Socket) of
+	{ok, Cert} ->
+	    Cert;
+	{error, no_peercert} -> 
+	    no_peercert;
+	_  ->
+	    undefined
+    end;
+which_peercert(_) -> %% Not an ssl connection
+    undefined.
+
 which_resolve(#mod{init_data = #init_data{resolve = Resolve}}) ->
     Resolve.
 
@@ -78,6 +91,7 @@ create_basic_elements(esi, ModData) ->
      {server_port,       which_port(ModData)},
      {request_method,    which_method(ModData)},
      {remote_addr,       which_peername(ModData)},
+     {peer_cert,         which_peercert(ModData)},
      {script_name,       which_request_uri(ModData)}];
 
 create_basic_elements(cgi, ModData) ->
diff --git a/lib/inets/test/httpd_SUITE.erl b/lib/inets/test/httpd_SUITE.erl
index 1d8a603981..93520c1cb4 100644
--- a/lib/inets/test/httpd_SUITE.erl
+++ b/lib/inets/test/httpd_SUITE.erl
@@ -755,7 +755,11 @@ esi(Config) when is_list(Config) ->
     %% Check "ErlScriptNoCache" directive (default: false)
     ok = http_status("GET /cgi-bin/erl/httpd_example:get ",
 		     Config, [{statuscode, 200},
-		      {no_header, "cache-control"}]).
+		      {no_header, "cache-control"}]),
+    ok = http_status("GET /cgi-bin/erl/httpd_example:peer ",
+	  	     Config, [{statuscode, 200},
+	 	      {header, "peer-cert-exist", peer(Config)}]).
+ 
 %%-------------------------------------------------------------------------
 mod_esi_chunk_timeout(Config) when is_list(Config) -> 
     ok = httpd_1_1:mod_esi_chunk_timeout(?config(type, Config), 
@@ -2065,3 +2069,11 @@ response_default_headers() ->
      {"X-Frame-Options", "SAMEORIGIN"},
      %% Override built-in default
      {"Date", "Override-date"}].
+
+peer(Config) ->
+   case proplists:get_value(type, Config) of
+      ssl ->
+        "true";
+      _ ->
+        "false"
+   end.   
\ No newline at end of file