mirror of
https://github.com/ClickHouse/ClickHouse.git
synced 2024-12-18 20:32:43 +00:00
137 lines
3.7 KiB
C++
137 lines
3.7 KiB
C++
#include "CertificateReloader.h"
|
|
|
|
#if USE_SSL
|
|
|
|
#include <base/logger_useful.h>
|
|
#include <base/errnoToString.h>
|
|
#include <Poco/Net/Context.h>
|
|
#include <Poco/Net/SSLManager.h>
|
|
#include <Poco/Net/Utility.h>
|
|
|
|
|
|
namespace DB
|
|
{
|
|
|
|
namespace
|
|
{
|
|
/// Call set process for certificate.
|
|
int callSetCertificate(SSL * ssl, [[maybe_unused]] void * arg)
|
|
{
|
|
return CertificateReloader::instance().setCertificate(ssl);
|
|
}
|
|
|
|
}
|
|
|
|
|
|
namespace ErrorCodes
|
|
{
|
|
extern const int CANNOT_STAT;
|
|
}
|
|
|
|
|
|
/// This is callback for OpenSSL. It will be called on every connection to obtain a certificate and private key.
|
|
int CertificateReloader::setCertificate(SSL * ssl)
|
|
{
|
|
auto current = data.get();
|
|
if (!current)
|
|
return -1;
|
|
|
|
SSL_use_certificate(ssl, const_cast<X509 *>(current->cert.certificate()));
|
|
SSL_use_PrivateKey(ssl, const_cast<EVP_PKEY *>(static_cast<const EVP_PKEY *>(current->key)));
|
|
|
|
int err = SSL_check_private_key(ssl);
|
|
if (err != 1)
|
|
{
|
|
std::string msg = Poco::Net::Utility::getLastError();
|
|
LOG_ERROR(log, "Unusable key-pair {}", msg);
|
|
return -1;
|
|
}
|
|
|
|
return 1;
|
|
}
|
|
|
|
|
|
void CertificateReloader::init()
|
|
{
|
|
LOG_DEBUG(log, "Initializing certificate reloader.");
|
|
|
|
/// Set a callback for OpenSSL to allow get the updated cert and key.
|
|
|
|
auto* ctx = Poco::Net::SSLManager::instance().defaultServerContext()->sslContext();
|
|
SSL_CTX_set_cert_cb(ctx, callSetCertificate, nullptr);
|
|
init_was_not_made = false;
|
|
}
|
|
|
|
|
|
void CertificateReloader::tryLoad(const Poco::Util::AbstractConfiguration & config)
|
|
{
|
|
/// If at least one of the files is modified - recreate
|
|
|
|
std::string new_cert_path = config.getString("openSSL.server.certificateFile", "");
|
|
std::string new_key_path = config.getString("openSSL.server.privateKeyFile", "");
|
|
|
|
/// For empty paths (that means, that user doesn't want to use certificates)
|
|
/// no processing required
|
|
|
|
if (new_cert_path.empty() || new_key_path.empty())
|
|
{
|
|
LOG_INFO(log, "One of paths is empty. Cannot apply new configuration for certificates. Fill all paths and try again.");
|
|
}
|
|
else
|
|
{
|
|
bool cert_file_changed = cert_file.changeIfModified(std::move(new_cert_path), log);
|
|
bool key_file_changed = key_file.changeIfModified(std::move(new_key_path), log);
|
|
|
|
if (cert_file_changed || key_file_changed)
|
|
{
|
|
LOG_DEBUG(log, "Reloading certificate ({}) and key ({}).", cert_file.path, key_file.path);
|
|
data.set(std::make_unique<const Data>(cert_file.path, key_file.path));
|
|
LOG_INFO(log, "Reloaded certificate ({}) and key ({}).", cert_file.path, key_file.path);
|
|
}
|
|
|
|
/// If callback is not set yet
|
|
try
|
|
{
|
|
if (init_was_not_made)
|
|
init();
|
|
}
|
|
catch (...)
|
|
{
|
|
init_was_not_made = true;
|
|
LOG_ERROR(log, fmt::runtime(getCurrentExceptionMessage(false)));
|
|
}
|
|
}
|
|
}
|
|
|
|
|
|
CertificateReloader::Data::Data(std::string cert_path, std::string key_path)
|
|
: cert(cert_path), key(/* public key */ "", /* private key */ key_path)
|
|
{
|
|
}
|
|
|
|
|
|
bool CertificateReloader::File::changeIfModified(std::string new_path, Poco::Logger * logger)
|
|
{
|
|
std::error_code ec;
|
|
std::filesystem::file_time_type new_modification_time = std::filesystem::last_write_time(new_path, ec);
|
|
if (ec)
|
|
{
|
|
LOG_ERROR(logger, "Cannot obtain modification time for {} file {}, skipping update. {}",
|
|
description, new_path, errnoToString(ErrorCodes::CANNOT_STAT, ec.value()));
|
|
return false;
|
|
}
|
|
|
|
if (new_path != path || new_modification_time != modification_time)
|
|
{
|
|
path = new_path;
|
|
modification_time = new_modification_time;
|
|
return true;
|
|
}
|
|
|
|
return false;
|
|
}
|
|
|
|
}
|
|
|
|
#endif
|