Sailesh Mukil has uploaded a new change for review. http://gerrit.cloudera.org:8080/7662
Change subject: KUDU-2091: Certificates with intermediate CA's do not work with Kudu ...................................................................... KUDU-2091: Certificates with intermediate CA's do not work with Kudu Kudu previously did not recognize chain certificates. This patch enables support for chain certificates by changing the Cert class' underlying data type to STACK_OF(X509) instead of just X509. STACK_OF(X509) allows multiple certificates to be held by the same pointer. When we are presented with a file or a string that contains multiple X509 certificates, they will be stored inside this STACK_OF(X509) object. When we call AddTrustedCertificate(Cert&), we iterate throught the STACK_OF(X509) contained in the Cert and add each one individually to the X509_STORE for later verification. Currently, IPKI does not make use of this ability and still works with single certificates. DCHECKS are added to make sure that multiple X509 certificates are not accidentally added to a Cert object. Although this patch provides a general framework to use chain certificates, if we want to use IPKI with chain certificates, additional functionality will need to be added with clearer APIs. External PKI makes use of this ability to add a chain CA if necessary. Testing: A new test is added to rpc-test that uses a chain CA. This test does not work without this patch. Change-Id: I7334a5b2f1643848152562bbb1dee27b5290e83f --- M src/kudu/rpc/rpc-test.cc M src/kudu/security/ca/cert_management.cc M src/kudu/security/cert.cc M src/kudu/security/cert.h M src/kudu/security/openssl_util.h M src/kudu/security/test/test_certs.cc M src/kudu/security/test/test_certs.h M src/kudu/security/tls_context.cc M src/kudu/security/tls_handshake.cc 9 files changed, 424 insertions(+), 48 deletions(-) git pull ssh://gerrit.cloudera.org:29418/kudu refs/changes/62/7662/1 -- To view, visit http://gerrit.cloudera.org:8080/7662 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-MessageType: newchange Gerrit-Change-Id: I7334a5b2f1643848152562bbb1dee27b5290e83f Gerrit-PatchSet: 1 Gerrit-Project: kudu Gerrit-Branch: master Gerrit-Owner: Sailesh Mukil <[email protected]>
