adamdebreceni commented on code in PR #1336:
URL: https://github.com/apache/nifi-minifi-cpp/pull/1336#discussion_r876913104
##########
libminifi/src/controllers/SSLContextService.cpp:
##########
@@ -175,51 +176,31 @@ bool SSLContextService::configure_ssl_context(SSL_CTX
*ctx) {
}
bool SSLContextService::addP12CertificateToSSLContext(SSL_CTX* ctx) const {
- const auto fp_deleter = [](BIO* ptr) { BIO_free(ptr); };
- std::unique_ptr<BIO, decltype(fp_deleter)> fp(BIO_new(BIO_s_file()),
fp_deleter);
- if (fp == nullptr) {
- core::logging::LOG_ERROR(logger_) << "Failed create new file BIO, " <<
getLatestOpenSSLErrorString();
- return false;
- }
- if (BIO_read_filename(fp.get(), certificate_.c_str()) <= 0) {
- core::logging::LOG_ERROR(logger_) << "Failed to read certificate file " <<
certificate_ << ", " << getLatestOpenSSLErrorString();
- return false;
- }
- const auto p12_deleter = [](PKCS12* ptr) { PKCS12_free(ptr); };
- std::unique_ptr<PKCS12, decltype(p12_deleter)> p12(d2i_PKCS12_bio(fp.get(),
nullptr), p12_deleter);
- if (p12 == nullptr) {
- core::logging::LOG_ERROR(logger_) << "Failed to DER decode certificate
file " << certificate_ << ", " << getLatestOpenSSLErrorString();
- return false;
- }
-
- EVP_PKEY* pkey = nullptr;
- X509* cert = nullptr;
- STACK_OF(X509)* ca = nullptr;
- if (!PKCS12_parse(p12.get(), passphrase_.c_str(), &pkey, &cert, &ca)) {
- core::logging::LOG_ERROR(logger_) << "Failed to parse certificate file "
<< certificate_ << " as PKCS#12, " << getLatestOpenSSLErrorString();
- return false;
- }
- utils::tls::EVP_PKEY_unique_ptr pkey_ptr{pkey};
- utils::tls::X509_unique_ptr cert_ptr{cert};
- const auto ca_deleter = gsl::finally([ca] { sk_X509_pop_free(ca, X509_free);
});
-
- if (SSL_CTX_use_certificate(ctx, cert) != 1) {
- core::logging::LOG_ERROR(logger_) << "Failed to set certificate from " <<
certificate_ << ", " << getLatestOpenSSLErrorString();
- return false;
- }
- while (ca != nullptr && sk_X509_num(ca) > 0) {
- utils::tls::X509_unique_ptr cacert{sk_X509_pop(ca)};
- if (SSL_CTX_add_extra_chain_cert(ctx, cacert.get()) != 1) {
- core::logging::LOG_ERROR(logger_) << "Failed to set additional
certificate from " << certificate_ << ", " << getLatestOpenSSLErrorString();
- return false;
+ auto error = utils::tls::processP12Certificate(certificate_, passphrase_, {
+ .cert_cb = [&] (auto& cert) -> std::optional<std::string> {
+ if (SSL_CTX_use_certificate(ctx, cert.get()) != 1) {
+ return utils::StringUtils::join_pack("Failed to set certificate from
", certificate_, ", ", getLatestOpenSSLErrorString());
Review Comment:
I think the only ones with "log-but-continue-on-error" behavior are the ones
on `verifyCertificateExpiration` (even in this case "callback-unrelated" errors
can occur and are logged)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
