socket: add certificate-depth and cipher-list options for SSL

Change-Id: I82757f8461807301a4a4f28c4f5bf7f0ee315113
BUG: 1114604
Signed-off-by: Jeff Darcy <jdarcy@redhat.com>
Reviewed-on: http://review.gluster.org/8040
Tested-by: Gluster Build System <jenkins@build.gluster.com>
Reviewed-by: Rajesh Joseph <rjoseph@redhat.com>
Reviewed-by: Vijay Bellur <vbellur@redhat.com>

1 files changed, 75 insertions, 0 deletions

diff --git a/xlators/mgmt/glusterd/src/glusterd-volgen.c b/xlators/mgmt/glusterd/src/glusterd-volgen.c
index 777e69535df..6ab899a16cf 100644
--- a/xlators/mgmt/glusterd/src/glusterd-volgen.c
+++ b/xlators/mgmt/glusterd/src/glusterd-volgen.c
@@ -1661,6 +1661,25 @@ server_graph_builder (volgen_graph_t *graph, glusterd_volinfo_t *volinfo,
                 if (NULL == ptranst)
                         return -1;
 
+                if (dict_get_str (set_dict, SSL_CERT_DEPTH_OPT, &value) == 0) {
+                        ret = xlator_set_option (rbxl, "ssl-cert-depth", value);
+                        if (ret) {
+                                gf_log ("glusterd", GF_LOG_WARNING,
+                                        "failed to set ssl-cert-depth");
+                                return -1;
+                        }
+                }
+
+                if (dict_get_str (set_dict, SSL_CIPHER_LIST_OPT, &value) == 0) {
+                        ret = xlator_set_option (rbxl, "ssl-cipher-list",
+                                                 value);
+                        if (ret) {
+                                gf_log ("glusterd", GF_LOG_WARNING,
+                                        "failed to set ssl-cipher-list");
+                                return -1;
+                        }
+                }
+
                 if (username) {
                         ret = xlator_set_option (rbxl, "username", username);
                         if (ret)
@@ -1798,6 +1817,24 @@ server_graph_builder (volgen_graph_t *graph, glusterd_volinfo_t *volinfo,
                         return -1;
         }
 
+        if (dict_get_str (set_dict, SSL_CERT_DEPTH_OPT, &value) == 0) {
+                ret = xlator_set_option (xl, "ssl-cert-depth", value);
+                if (ret) {
+                        gf_log ("glusterd", GF_LOG_WARNING,
+                                "failed to set ssl-cert-depth");
+                        return -1;
+                }
+        }
+
+        if (dict_get_str (set_dict, SSL_CIPHER_LIST_OPT, &value) == 0) {
+                ret = xlator_set_option (xl, "ssl-cipher-list", value);
+                if (ret) {
+                        gf_log ("glusterd", GF_LOG_WARNING,
+                                "failed to set ssl-cipher-list");
+                        return -1;
+                }
+        }
+
         if (username) {
                 memset (key, 0, sizeof (key));
                 snprintf (key, sizeof (key), "auth.login.%s.allow", path);
@@ -2225,6 +2262,7 @@ volgen_graph_build_client (volgen_graph_t *graph, glusterd_volinfo_t *volinfo,
         char                    *str                = NULL;
         char                    *ssl_str            = NULL;
         gf_boolean_t             ssl_bool           = _gf_false;
+        char                    *value              = NULL;
 
         GF_ASSERT (graph);
         GF_ASSERT (subvol);
@@ -2289,6 +2327,24 @@ volgen_graph_build_client (volgen_graph_t *graph, glusterd_volinfo_t *volinfo,
                 }
         }
 
+        if (dict_get_str (set_dict, SSL_CERT_DEPTH_OPT, &value) == 0) {
+                ret = xlator_set_option (xl, "ssl-cert-depth", value);
+                if (ret) {
+                        gf_log ("glusterd", GF_LOG_WARNING,
+                                "failed to set ssl-cert-depth");
+                        goto err;
+                }
+        }
+
+        if (dict_get_str (set_dict, SSL_CIPHER_LIST_OPT, &value) == 0) {
+                ret = xlator_set_option (xl, "ssl-cipher-list", value);
+                if (ret) {
+                        gf_log ("glusterd", GF_LOG_WARNING,
+                                "failed to set ssl-cipher-list");
+                        goto err;
+                }
+        }
+
         return xl;
 err:
         return NULL;
@@ -4124,6 +4180,7 @@ glusterd_generate_snapd_volfile (volgen_graph_t *graph,
         dict_t         *set_dict        = NULL;
         char           *loglevel        = NULL;
         char           *xlator          = NULL;
+        char           *value           = NULL;
 
         set_dict = dict_copy (volinfo->dict, NULL);
         if (!set_dict)
@@ -4167,6 +4224,24 @@ glusterd_generate_snapd_volfile (volgen_graph_t *graph,
         if (ret)
                 return -1;
 
+        if (dict_get_str (set_dict, SSL_CERT_DEPTH_OPT, &value) == 0) {
+                ret = xlator_set_option (xl, "ssl-cert-depth", value);
+                if (ret) {
+                        gf_log ("glusterd", GF_LOG_WARNING,
+                                "failed to set ssl-cert-depth");
+                        return -1;
+                }
+        }
+
+        if (dict_get_str (set_dict, SSL_CIPHER_LIST_OPT, &value) == 0) {
+                ret = xlator_set_option (xl, "ssl-cipher-list", value);
+                if (ret) {
+                        gf_log ("glusterd", GF_LOG_WARNING,
+                                "failed to set ssl-cipher-list");
+                        return -1;
+                }
+        }
+
         username = glusterd_auth_get_username (volinfo);
         passwd = glusterd_auth_get_password (volinfo);