Changeset: 5e4c7cadbaa1 for MonetDB
URL: https://dev.monetdb.org/hg/MonetDB/rev/5e4c7cadbaa1
Modified Files:
tools/merovingian/daemon/client.c
tools/merovingian/daemon/merovingian.c
Branch: smapi
Log Message:
Validate TLS properties at startup
diffs (78 lines):
diff --git a/tools/merovingian/daemon/client.c
b/tools/merovingian/daemon/client.c
--- a/tools/merovingian/daemon/client.c
+++ b/tools/merovingian/daemon/client.c
@@ -86,29 +86,14 @@ handleClient(void *data)
free(data);
#ifdef HAVE_OPENSSL
char *ct_fname, *kp_fname;
- kv = findConfKey(_mero_props, "use_tls");
- bool use_tls_prop = (bool)kv->ival;
- bool tls_configured = false;
-
- kv = findConfKey(_mero_props, "tls_cert");
- if (kv != NULL) {
- ct_fname = strdup(kv->val);
+ bool use_tls = (bool)getConfNum(_mero_props, "use_tls");
- kv = findConfKey(_mero_props, "tls_key");
- if (kv != NULL) {
- kp_fname = strdup(kv->val);
- tls_configured = true;
- }
- }
- if (use_tls_prop) {
- if (tls_configured) {
- fdin = open_tls_server_stream(sock,
"merovingian<-client (tls read)", NULL, kp_fname, ct_fname);
- free(kp_fname);
- free(ct_fname);
- } else {
- // Error, refuse to start? Should have been handled
earlier?
- abort();
- }
+ if (use_tls) {
+ ct_fname = strdup(getConfVal(_mero_props, "tls_cert"));
+ kp_fname = strdup(getConfVal(_mero_props, "tls_key"));
+ fdin = open_tls_server_stream(sock, "merovingian<-client (tls
read)", NULL, kp_fname, ct_fname);
+ free(kp_fname);
+ free(ct_fname);
}
else {
fdin = socket_rstream(sock, "merovingian<-client (read)");
@@ -127,7 +112,7 @@ handleClient(void *data)
* read write. On the other hand openssl has
* one object (BIO) that handles both directions.
*/
- if (use_tls_prop) {
+ if (use_tls) {
fout = open_tls_server_stream(sock, "merovingian->client (tls
write)", fdin, NULL, NULL);
}
else {
diff --git a/tools/merovingian/daemon/merovingian.c
b/tools/merovingian/daemon/merovingian.c
--- a/tools/merovingian/daemon/merovingian.c
+++ b/tools/merovingian/daemon/merovingian.c
@@ -783,6 +783,25 @@ main(int argc, char *argv[])
MERO_EXIT_CLEAN(1);
}
+#ifdef HAVE_OPENSSL
+ bool use_tls = (bool)getConfNum(_mero_props, "use_tls");
+
+ // TLS requested. Make sure we have both a certificate and a private
+ // key file.
+ if (use_tls) {
+ p = getConfVal(_mero_props, "tls_cert");
+ if(p == NULL) {
+ Mlevelfprintf(ERROR, stderr, "TLS requested but
tls_cert not set\n");
+ MERO_EXIT_CLEAN(1);
+ }
+ p = getConfVal(_mero_props, "tls_key");
+ if(p == NULL) {
+ Mlevelfprintf(ERROR, stderr, "TLS requested but tls_key
not set\n");
+ MERO_EXIT_CLEAN(1);
+ }
+ }
+#endif // HAVE_OPENSSL
+
/* time to initialize the stream library */
if (mnstr_init() < 0) {
Mlevelfprintf(ERROR, stderr, "cannot initialize stream
library\n");
_______________________________________________
checkin-list mailing list -- [email protected]
To unsubscribe send an email to [email protected]
