summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorEmmanuel Dreyfus <manu@netbsd.org>2015-08-05 17:19:29 +0200
committerKaleb KEITHLEY <kkeithle@redhat.com>2015-08-23 23:19:22 -0700
commit036ef63536d749b47b1c719bd92ff382ad75fb8b (patch)
treef72595e3943dc9dfceaf109fa2e0f2f2e14059f9
parent1626fb105c99ef623be3687f3f48d9247ab9b7c4 (diff)
SSL improvements: do not fail if certificate purpose is set
Since glusterfs shares the same settings for client-side and server-side of SSL, we need to ignore any certificate usage specification (SSL client vs SSL server), otherwise SSL connexions will fail with 'unsupported cerritifcate" BUG: 1247152 Change-Id: I7ef60271718d2d894176515aa530ff106127bceb Signed-off-by: Emmanuel Dreyfus <manu@netbsd.org> Reviewed-on: http://review.gluster.org/11840 Tested-by: Gluster Build System <jenkins@build.gluster.com> Reviewed-by: Kaleb KEITHLEY <kkeithle@redhat.com> Reviewed-by: Jeff Darcy <jdarcy@redhat.com>
-rw-r--r--rpc/rpc-transport/socket/src/socket.c8
-rw-r--r--rpc/rpc-transport/socket/src/socket.h1
2 files changed, 9 insertions, 0 deletions
diff --git a/rpc/rpc-transport/socket/src/socket.c b/rpc/rpc-transport/socket/src/socket.c
index 52b3e4bebd4..b0b1b99db10 100644
--- a/rpc/rpc-transport/socket/src/socket.c
+++ b/rpc/rpc-transport/socket/src/socket.c
@@ -4110,6 +4110,14 @@ socket_init (rpc_transport_t *this)
sizeof(priv->ssl_session_id));
SSL_CTX_set_verify(priv->ssl_ctx,SSL_VERIFY_PEER,0);
+
+ /*
+ * Since glusterfs shares the same settings for client-side
+ * and server-side of SSL, we need to ignore any certificate
+ * usage specification (SSL client vs SSL server), otherwise
+ * SSL connexions will fail with 'unsupported cerritifcate"
+ */
+ SSL_CTX_set_purpose(priv->ssl_ctx, X509_PURPOSE_ANY);
}
if (priv->own_thread) {
diff --git a/rpc/rpc-transport/socket/src/socket.h b/rpc/rpc-transport/socket/src/socket.h
index e30d2ece992..6fc845ac286 100644
--- a/rpc/rpc-transport/socket/src/socket.h
+++ b/rpc/rpc-transport/socket/src/socket.h
@@ -13,6 +13,7 @@
#include <openssl/ssl.h>
#include <openssl/err.h>
+#include <openssl/x509v3.h>
#include "event.h"
#include "rpc-transport.h"