Changeset: bbce097d17f3 for MonetDB
URL: https://dev.monetdb.org/hg/MonetDB/rev/bbce097d17f3
Modified Files:
common/stream/stream.h
common/stream/tls_stream.c
tools/merovingian/daemon/client.c
Branch: smapi
Log Message:
Accept/negotiate TLS connection
If HAVE_OPENSSL is defined at configure time use a tls connection by
default. Does not yet work and it should probably change so that users
have more control with this.
diffs (107 lines):
diff --git a/common/stream/stream.h b/common/stream/stream.h
--- a/common/stream/stream.h
+++ b/common/stream/stream.h
@@ -164,7 +164,7 @@ stream_export void close_stream(stream *
stream_export stream *open_urlstream(const char *url); // mclient.c, future
copy from remote
-stream_export stream *open_tls_serv_stream(int fd);
+stream_export stream *open_tls_serv_stream(int fd, const char *name, bool
readonly);
stream_export stream *file_rstream(FILE *restrict fp, bool binary, const char
*restrict name); // unused
stream_export stream *file_wstream(FILE *restrict fp, bool binary, const char
*restrict name); // unused
diff --git a/common/stream/tls_stream.c b/common/stream/tls_stream.c
--- a/common/stream/tls_stream.c
+++ b/common/stream/tls_stream.c
@@ -11,6 +11,7 @@
#include "monetdb_config.h"
#include "stream.h"
#include "stream_internal.h"
+#include <stdio.h>
/* ---------------------------------------------- */
/* streams working over TLS */
@@ -43,8 +44,14 @@ tls_read(stream *restrict s, void *restr
return SSL_read(w->cSSL, buf, elmsize*cnt);
}
+static void
+tls_close(stream *s) {
+ ssl_wrapper *w = (ssl_wrapper *)s->stream_data.p;
+ SSL_shutdown(w->cSSL);
+}
+
stream *
-open_tls_serv_stream(int fd)
+open_tls_serv_stream(int fd, const char *name, bool readonly)
{
int ssl_err = 1;
stream *ret;
@@ -61,9 +68,8 @@ open_tls_serv_stream(int fd)
return NULL;
}
-
/* TODO parametrize */
- const char *server_keypair_fname =
"/home/kutsurak/src/monetdb/mercurial-repos/public/smapi/smapi-dev-certificates/leaf_keypair.pem";
+ const char *server_keypair_fname =
"/home/kutsurak/src/monetdb/mercurial-repos/public/smapi/smapi-dev-certificates/new/server_keypair.pem";
ssl_err = SSL_CTX_use_PrivateKey_file(w->ctx, server_keypair_fname,
SSL_FILETYPE_PEM);
if (ssl_err <= 0) {
/* TODO handle */
@@ -71,10 +77,11 @@ open_tls_serv_stream(int fd)
}
/* TODO parametrize */
- const char *server_cert_chain_fname =
"/home/kutsurak/src/monetdb/mercurial-repos/public/smapi/smapi-dev-certificates/leaf_cert.pem";
+ const char *server_cert_chain_fname =
"/home/kutsurak/src/monetdb/mercurial-repos/public/smapi/smapi-dev-certificates/server_cert.pem";
ssl_err = SSL_CTX_use_certificate_chain_file(w->ctx,
server_cert_chain_fname);
if (ssl_err <= 0) {
/* TODO handle */
+ ERR_print_errors_fp(stdout);
return NULL;
}
@@ -96,14 +103,16 @@ open_tls_serv_stream(int fd)
}
- if ((ret = create_stream("server_ssl_stream")) == NULL) {
+ if ((ret = create_stream(name)) == NULL) {
return NULL;
}
ret->stream_data.p = w;
+ ret->readonly = readonly;
ret->read = tls_read;
ret->write = tls_write;
+ ret->close = tls_close;
return ret;
}
diff --git a/tools/merovingian/daemon/client.c
b/tools/merovingian/daemon/client.c
--- a/tools/merovingian/daemon/client.c
+++ b/tools/merovingian/daemon/client.c
@@ -84,14 +84,22 @@ handleClient(void *data)
self = ((struct clientdata *) data)->self;
memcpy(chal, ((struct clientdata *) data)->challenge, sizeof(chal));
free(data);
+#ifdef HAVE_OPENSSL
+ fdin = open_tls_serv_stream(sock, "merovingian<-client (tls read)",
true);
+#else
fdin = socket_rstream(sock, "merovingian<-client (read)");
+#endif // HAVE_OPENSSL
if (fdin == NULL) {
self->dead = true;
return(newErr("merovingian-client inputstream problems: %s",
mnstr_peek_error(NULL)));
}
fdin = block_stream(fdin);
+#ifdef HAVE_OPENSSL
+ fout = open_tls_serv_stream(sock, "merovingian->client (tls write)",
false);
+#else
fout = socket_wstream(sock, "merovingian->client (write)");
+#endif // HAVE_OPENSSL
if (fout == 0) {
close_stream(fdin);
self->dead = true;
_______________________________________________
checkin-list mailing list -- [email protected]
To unsubscribe send an email to [email protected]
