Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

HPCC-30716 Improve wsdfs secret/cert error reporting #17981

Merged
merged 1 commit into from
Nov 9, 2023
Merged

HPCC-30716 Improve wsdfs secret/cert error reporting #17981

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions esp/bindings/SOAP/Platform/soapbind.hpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -207,6 +207,20 @@ class esp_http_decl CSoapRequestBinding : public CSoapComplexType,
}
};

inline void setRpcSSLOptionsBuf(IEspClientRpcSettings &rpc, bool useSSL, const char *clientCertBuf, const char *clientPrivateKeyBuf, const char *caCertBuf, bool acceptSelfSigned)
{
if (useSSL)
{
// NB: assume that caller has verified the content of the buffers contain embedded keys
rpc.setClientCertificate(clientCertBuf, clientPrivateKeyBuf);

if (!isEmptyString(caCertBuf))
rpc.setCACertificates(caCertBuf);

rpc.setAcceptSelfSigned(acceptSelfSigned);
}
}

inline void setRpcSSLOptions(IEspClientRpcSettings &rpc, bool useSSL, const char *clientCert, const char *clientPrivateKey, const char *caCert, bool acceptSelfSigned)
{
if (useSSL)
Expand Down
20 changes: 15 additions & 5 deletions esp/clients/ws_dfsclient/ws_dfsclient.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -592,15 +592,25 @@ static void configureClientSSL(IEspClientRpcSettings &rpc, const char *secretNam
throw makeStringExceptionV(-1, "secret %s.%s not found", "storage", secretName);

StringBuffer certSecretBuf;
getSecretKeyValue(certSecretBuf, secretPTree, "tls.crt");
if (!getSecretKeyValue(certSecretBuf, secretPTree, "tls.crt"))
throw makeStringExceptionV(-1, "Client certificate 'tls.crt' missing from secret '%s'.", secretName);
if (!containsEmbeddedKey(certSecretBuf))
throw makeStringExceptionV(-1, "Client certificate content 'tls.crt' for secret '%s' not in expected format.", secretName);

StringBuffer privKeySecretBuf;
getSecretKeyValue(privKeySecretBuf, secretPTree, "tls.key");
if (!getSecretKeyValue(privKeySecretBuf, secretPTree, "tls.key"))
throw makeStringExceptionV(-1, "Client private key 'tls.crt' missing from secret '%s'.", secretName);
if (!containsEmbeddedKey(privKeySecretBuf))
throw makeStringExceptionV(-1, "Client private key content 'tls.key' for secret '%s' not in expected format.", secretName);

StringBuffer caCertFileBuf;
getSecretKeyValue(caCertFileBuf, secretPTree, "ca.crt");
StringBuffer caCertBuf;
if (getSecretKeyValue(caCertBuf, secretPTree, "ca.crt"))
{
if (!containsEmbeddedKey(caCertBuf))
throw makeStringExceptionV(-1, "CA certificate content 'ca.crt' for secret '%s' not in expected format.", secretName);
}

setRpcSSLOptions(rpc, true, certSecretBuf.str(), privKeySecretBuf.str(), caCertFileBuf.str(), false);
setRpcSSLOptionsBuf(rpc, true, certSecretBuf.str(), privKeySecretBuf.str(), caCertBuf.str(), false);
}

static CriticalSection serviceLeaseMapCS;
Expand Down