From 036ef63536d749b47b1c719bd92ff382ad75fb8b Mon Sep 17 00:00:00 2001 From: Emmanuel Dreyfus Date: Wed, 5 Aug 2015 17:19:29 +0200 Subject: SSL improvements: do not fail if certificate purpose is set Since glusterfs shares the same settings for client-side and server-side of SSL, we need to ignore any certificate usage specification (SSL client vs SSL server), otherwise SSL connexions will fail with 'unsupported cerritifcate" BUG: 1247152 Change-Id: I7ef60271718d2d894176515aa530ff106127bceb Signed-off-by: Emmanuel Dreyfus Reviewed-on: http://review.gluster.org/11840 Tested-by: Gluster Build System Reviewed-by: Kaleb KEITHLEY Reviewed-by: Jeff Darcy --- rpc/rpc-transport/socket/src/socket.c | 8 ++++++++ rpc/rpc-transport/socket/src/socket.h | 1 + 2 files changed, 9 insertions(+) (limited to 'rpc') diff --git a/rpc/rpc-transport/socket/src/socket.c b/rpc/rpc-transport/socket/src/socket.c index 52b3e4bebd4..b0b1b99db10 100644 --- a/rpc/rpc-transport/socket/src/socket.c +++ b/rpc/rpc-transport/socket/src/socket.c @@ -4110,6 +4110,14 @@ socket_init (rpc_transport_t *this) sizeof(priv->ssl_session_id)); SSL_CTX_set_verify(priv->ssl_ctx,SSL_VERIFY_PEER,0); + + /* + * Since glusterfs shares the same settings for client-side + * and server-side of SSL, we need to ignore any certificate + * usage specification (SSL client vs SSL server), otherwise + * SSL connexions will fail with 'unsupported cerritifcate" + */ + SSL_CTX_set_purpose(priv->ssl_ctx, X509_PURPOSE_ANY); } if (priv->own_thread) { diff --git a/rpc/rpc-transport/socket/src/socket.h b/rpc/rpc-transport/socket/src/socket.h index e30d2ece992..6fc845ac286 100644 --- a/rpc/rpc-transport/socket/src/socket.h +++ b/rpc/rpc-transport/socket/src/socket.h @@ -13,6 +13,7 @@ #include #include +#include #include "event.h" #include "rpc-transport.h" -- cgit