Changeset: b4ccbe3a3fe6 for MonetDB
URL: https://dev.monetdb.org/hg/MonetDB/rev/b4ccbe3a3fe6
Modified Files:
clients/mapilib/Tests/tlssecurity.py
clients/mapilib/connect_openssl.c
clients/mapilib/msettings.h
Branch: monetdburl
Log Message:
Implement client certificates
diffs (73 lines):
diff --git a/clients/mapilib/Tests/tlssecurity.py
b/clients/mapilib/Tests/tlssecurity.py
--- a/clients/mapilib/Tests/tlssecurity.py
+++ b/clients/mapilib/Tests/tlssecurity.py
@@ -143,8 +143,7 @@ attempt('refuse_expired', 'expiredcert',
# Authenticate using client2.key and client2.crt. Have a succesful MAPI
# exchange.
-# TODO
-#attempt('connect_client_auth', 'clientauth', None,
cert=certpath('ca1.crt'),clientcert=certpath('client2.crt'),
clientkey=certpath('client2.key'))
+attempt('connect_client_auth', 'clientauth', None, cert=certpath('ca1.crt'),
clientcert=certpath('client2.crt'), clientkey=certpath('client2.key'))
# fail_plain_to_tls
#
diff --git a/clients/mapilib/connect_openssl.c
b/clients/mapilib/connect_openssl.c
--- a/clients/mapilib/connect_openssl.c
+++ b/clients/mapilib/connect_openssl.c
@@ -125,6 +125,11 @@ wrap_tls(Mapi mid, SOCKET sock)
size_t hostlen = strlen(host);
size_t hostportlen = hostlen + 1 + 20;
+ const char *clientkey = msetting_string(settings, MP_CLIENTKEY);
+ const char *clientcert = msetting_string(settings, MP_CLIENTCERT);
+ if (!clientcert[0])
+ clientcert = clientkey; // this logic should be virtual
parameters in the spec!
+
// Clear any earlier errrors
do {} while (ERR_get_error() != 0);
@@ -192,10 +197,29 @@ wrap_tls(Mapi mid, SOCKET sock)
return croak_openssl(mid, __func__, "SSL_set_tlsext_host_name");
}
+ // if target.clientkey:
+ // ssl_context.load_cert_chain(
+ // certfile=target.clientcert if target.clientcert is not None
else target.clientkey,
+ // keyfile=target.clientkey,
+ // password=target.clientkeypassword,
+ // )
+ assert(clientkey);
+ assert(clientcert);
+ if (clientkey[0]) {
+ if (1 != SSL_use_PrivateKey_file(ssl, clientkey,
SSL_FILETYPE_PEM)) {
+ BIO_free_all(bio);
+ return croak_openssl(mid, __func__,
"SSL_use_PrivateKey_file");
+ }
+ if (1 != SSL_use_certificate_chain_file(ssl, clientcert)) {
+ BIO_free_all(bio);
+ return croak_openssl(mid, __func__,
"SSL_use_certificate_chain_file");
+ }
+ }
+
// handshake
if (1 != SSL_connect(ssl)) {
BIO_free_all(bio);
- return croak_openssl(mid, __func__, "SSL_connect");
+ return croak_openssl(mid, __func__, "SSL_connect handshake");
}
/////////////////////////////////////////////////////////////////////
diff --git a/clients/mapilib/msettings.h b/clients/mapilib/msettings.h
--- a/clients/mapilib/msettings.h
+++ b/clients/mapilib/msettings.h
@@ -48,8 +48,8 @@ typedef enum mparm {
MP_SOCK = MP__STRING_START,
MP_SOCKDIR,
MP_CERT,
- MP_CLIENTKEY, // TODO implement this
- MP_CLIENTCERT, // TODO implement this
+ MP_CLIENTKEY,
+ MP_CLIENTCERT,
MP_HOST,
MP_DATABASE,
MP_TABLESCHEMA,
_______________________________________________
checkin-list mailing list -- [email protected]
To unsubscribe send an email to [email protected]
