(program (programItem (section SEND_RESPONSE { (sectionBody (conditional (ifStatement if (condition (expression (term (factor inbound.conn.TLS)))) (block { (blockItem (statement inbound.resp.X-Client-Cert = (value "{inbound.conn.client-cert.PEM}") ;)) (blockItem (statement inbound.resp.X-Client-Cert-Subject = (value "{inbound.conn.client-cert.SUBJECT}") ;)) (blockItem (statement inbound.resp.X-Client-Cert-Issuer = (value "{inbound.conn.client-cert.ISSUER}") ;)) (blockItem (statement inbound.resp.X-Server-Cert-Subject = (value "{inbound.conn.server-cert.SUBJECT}") ;)) (blockItem (statement inbound.resp.X-Server-Cert-Serial = (value "{inbound.conn.server-cert.SERIAL}") ;)) (blockItem (statement inbound.resp.X-Client-SAN-DNS = (value "{inbound.conn.client-cert.SAN.DNS}") ;)) (blockItem (statement inbound.resp.X-Client-SAN-IP = (value "{inbound.conn.client-cert.SAN.IP}") ;)) (blockItem (statement inbound.resp.X-Server-SAN-Email = (value "{inbound.conn.server-cert.SAN.EMAIL}") ;)) (blockItem (statement inbound.resp.X-Server-SAN-URI = (value "{inbound.conn.server-cert.SAN.URI}") ;)) })))) })) (programItem (section SEND_REQUEST { (sectionBody (conditional (ifStatement if (condition (expression (term (factor (comparison (comparable inbound.conn.client-cert.SAN.DNS) ~ (regex /example\.com/)))))) (block { (blockItem (statement outbound.req.X-Matched-Domain = (value "true") ;)) })))) (sectionBody (conditional (ifStatement if (condition (expression (term (factor (comparison (comparable inbound.conn.client-cert.SUBJECT) ~ (regex /CN=testcert/)))))) (block { (blockItem (statement outbound.req.X-Test-Client = (value "verified") ;)) })))) })) (programItem (section READ_RESPONSE { (sectionBody (statement outbound.resp.X-Outbound-Client-Cert = (value "{outbound.conn.client-cert.PEM}") ;)) (sectionBody (statement outbound.resp.X-Outbound-Server-Subject = (value "{outbound.conn.server-cert.SUBJECT}") ;)) })) <EOF>)
