2020-10-08 16:07:58 +00:00
|
|
|
#pragma once
|
|
|
|
|
|
|
|
#include <unistd.h>
|
|
|
|
#include <sys/stat.h>
|
|
|
|
#include <sys/types.h>
|
|
|
|
|
|
|
|
#include <memory>
|
|
|
|
#include <mutex>
|
|
|
|
#include <shared_mutex>
|
|
|
|
#include <string>
|
|
|
|
#include <utility>
|
|
|
|
|
|
|
|
#include <Poco/Logger.h>
|
|
|
|
#include <Poco/Util/AbstractConfiguration.h>
|
|
|
|
|
|
|
|
#include <common/logger_useful.h>
|
|
|
|
|
|
|
|
#if !defined(ARCADIA_BUILD)
|
|
|
|
# include <Common/config.h>
|
|
|
|
#endif
|
|
|
|
|
|
|
|
#if USE_SSL
|
|
|
|
# include <openssl/ssl.h>
|
|
|
|
# include <openssl/x509v3.h>
|
|
|
|
# include <Poco/Crypto/RSAKey.h>
|
|
|
|
# include <Poco/Crypto/X509Certificate.h>
|
|
|
|
# include <Poco/Net/Context.h>
|
|
|
|
# include <Poco/Net/SSLManager.h>
|
|
|
|
# include <Poco/Net/Utility.h>
|
|
|
|
#endif
|
|
|
|
|
|
|
|
namespace DB
|
|
|
|
{
|
2021-07-06 23:15:30 +00:00
|
|
|
#if USE_SSL
|
2020-10-08 16:07:58 +00:00
|
|
|
|
2021-07-06 23:15:30 +00:00
|
|
|
/// The CertificateReloader singleton performs 2 functions:
|
2020-10-08 16:07:58 +00:00
|
|
|
/// 1. Dynamic reloading of TLS keypair when requested by main:
|
2021-07-06 23:15:30 +00:00
|
|
|
/// Main notifies CertificateReloader when the config changes. On changed config,
|
|
|
|
/// CertificateReloader reloads certs from disk.
|
2020-10-08 16:07:58 +00:00
|
|
|
/// 2. Implement `SSL_CTX_set_cert_cb` to set certificate for a new connection:
|
|
|
|
/// OpenSSL invokes `cert_reloader_dispatch_set_cert` to setup a connection.
|
2021-07-06 23:15:30 +00:00
|
|
|
class CertificateReloader
|
2020-10-08 16:07:58 +00:00
|
|
|
{
|
|
|
|
public:
|
|
|
|
using stat_t = struct stat;
|
|
|
|
|
|
|
|
/// Singleton
|
2021-07-06 23:15:30 +00:00
|
|
|
CertificateReloader(CertificateReloader const &) = delete;
|
|
|
|
void operator=(CertificateReloader const &) = delete;
|
|
|
|
static CertificateReloader & instance()
|
2020-10-08 16:07:58 +00:00
|
|
|
{
|
2021-07-06 23:15:30 +00:00
|
|
|
static CertificateReloader instance;
|
2020-10-08 16:07:58 +00:00
|
|
|
return instance;
|
|
|
|
}
|
|
|
|
|
|
|
|
/// Initialize the callback and perfom the initial cert loading
|
2021-07-07 00:13:37 +00:00
|
|
|
void init(const Poco::Util::AbstractConfiguration & config);
|
2020-10-08 16:07:58 +00:00
|
|
|
|
|
|
|
/// Handle configuration reload
|
|
|
|
void reload(const Poco::Util::AbstractConfiguration & config);
|
|
|
|
|
2021-07-06 23:15:30 +00:00
|
|
|
/// Add cert, key to SSL* connection. SetCertificate runs in an IO thread during
|
|
|
|
/// connection setup. SetCertificate is
|
2020-10-08 16:07:58 +00:00
|
|
|
/// establishing a new TLS connection.
|
2021-07-06 23:15:30 +00:00
|
|
|
int setCertificate(SSL * ssl);
|
2020-10-08 16:07:58 +00:00
|
|
|
|
|
|
|
private:
|
2021-07-06 23:15:30 +00:00
|
|
|
CertificateReloader()
|
2021-07-06 22:18:41 +00:00
|
|
|
{
|
|
|
|
}
|
2020-10-08 16:07:58 +00:00
|
|
|
|
2021-07-06 22:19:05 +00:00
|
|
|
mutable std::shared_mutex mutex;
|
2021-07-06 23:15:30 +00:00
|
|
|
Poco::Logger * log = &Poco::Logger::get("CertificateReloader");
|
2020-10-08 16:07:58 +00:00
|
|
|
|
|
|
|
std::string cert_file;
|
|
|
|
stat_t cert_file_st;
|
|
|
|
std::unique_ptr<Poco::Crypto::X509Certificate> cert;
|
2021-07-06 23:15:30 +00:00
|
|
|
bool setCertificateFile(std::string cert_file);
|
2020-10-08 16:07:58 +00:00
|
|
|
|
|
|
|
std::string key_file;
|
|
|
|
stat_t key_file_st;
|
|
|
|
std::unique_ptr<Poco::Crypto::RSAKey> key;
|
|
|
|
bool setKeyFile(std::string key_file);
|
|
|
|
};
|
|
|
|
|
2021-07-06 23:15:30 +00:00
|
|
|
#else
|
|
|
|
|
|
|
|
class CertificateReloader
|
|
|
|
{
|
|
|
|
public:
|
|
|
|
static CertificateReloader & instance()
|
|
|
|
{
|
|
|
|
static CertificateReloader instance;
|
|
|
|
return instance;
|
|
|
|
}
|
|
|
|
|
2021-07-07 00:13:37 +00:00
|
|
|
void init(const Poco::Util::AbstractConfiguration &)
|
|
|
|
{
|
|
|
|
}
|
2021-07-06 23:15:30 +00:00
|
|
|
|
2021-07-07 00:13:37 +00:00
|
|
|
void reload(const Poco::Util::AbstractConfiguration &)
|
|
|
|
{
|
|
|
|
}
|
2021-07-06 23:15:30 +00:00
|
|
|
};
|
|
|
|
|
2020-10-08 16:07:58 +00:00
|
|
|
#endif
|
|
|
|
}
|