| 18 | #endif |
| 19 | |
| 20 | DB::TLSHandler::TLSHandler( |
| 21 | const StreamSocket & socket, |
| 22 | [[maybe_unused]] const LayeredConfiguration & config_, |
| 23 | [[maybe_unused]] const std::string & prefix_, |
| 24 | TCPProtocolStackData & stack_data_) |
| 25 | : Poco::Net::TCPServerConnection(socket) |
| 26 | #if USE_SSL |
| 27 | , config(config_) |
| 28 | , prefix(prefix_) |
| 29 | #endif |
| 30 | , stack_data(stack_data_) |
| 31 | { |
| 32 | #if USE_SSL |
| 33 | params.privateKeyFile = config.getString(prefix + SSLManager::CFG_PRIV_KEY_FILE, ""); |
| 34 | params.certificateFile = config.getString(prefix + SSLManager::CFG_CERTIFICATE_FILE, params.privateKeyFile); |
| 35 | |
| 36 | if (params.privateKeyFile.empty() || params.certificateFile.empty()) |
| 37 | { |
| 38 | LOG_DEBUG(&Poco::Logger::get("TLSHandler"), "No private key and/or certificate specified for TLS, using default context."); |
| 39 | return; |
| 40 | } |
| 41 | |
| 42 | params.caLocation = config.getString(prefix + SSLManager::CFG_CA_LOCATION, ""); |
| 43 | if (params.caLocation.empty()) |
| 44 | { |
| 45 | auto ctx = SSLManager::instance().defaultServerContext(); |
| 46 | params.caLocation = ctx->getCAPaths().caLocation; |
| 47 | } |
| 48 | |
| 49 | // optional options for which we have defaults defined |
| 50 | params.verificationMode = SSLManager::VAL_VER_MODE; |
| 51 | if (config.hasProperty(prefix + SSLManager::CFG_VER_MODE)) |
| 52 | { |
| 53 | // either: none, relaxed, strict, once |
| 54 | std::string mode = config.getString(prefix + SSLManager::CFG_VER_MODE); |
| 55 | params.verificationMode = Poco::Net::Utility::convertVerificationMode(mode); |
| 56 | } |
| 57 | |
| 58 | params.verificationDepth = config.getInt(prefix + SSLManager::CFG_VER_DEPTH, SSLManager::VAL_VER_DEPTH); |
| 59 | params.loadDefaultCAs = config.getBool(prefix + SSLManager::CFG_ENABLE_DEFAULT_CA, SSLManager::VAL_ENABLE_DEFAULT_CA); |
| 60 | params.cipherList = config.getString(prefix + SSLManager::CFG_CIPHER_LIST, SSLManager::VAL_CIPHER_LIST); |
| 61 | params.cipherList = config.getString(prefix + SSLManager::CFG_CYPHER_LIST, params.cipherList); // for backwards compatibility |
| 62 | |
| 63 | bool require_tlsv1 = config.getBool(prefix + SSLManager::CFG_REQUIRE_TLSV1, false); |
| 64 | bool require_tlsv1_1 = config.getBool(prefix + SSLManager::CFG_REQUIRE_TLSV1_1, false); |
| 65 | bool require_tlsv1_2 = config.getBool(prefix + SSLManager::CFG_REQUIRE_TLSV1_2, false); |
| 66 | if (require_tlsv1_2) |
| 67 | usage = Context::TLSV1_2_SERVER_USE; |
| 68 | else if (require_tlsv1_1) |
| 69 | usage = Context::TLSV1_1_SERVER_USE; |
| 70 | else if (require_tlsv1) |
| 71 | usage = Context::TLSV1_SERVER_USE; |
| 72 | else |
| 73 | usage = Context::SERVER_USE; |
| 74 | |
| 75 | params.dhParamsFile = config.getString(prefix + SSLManager::CFG_DH_PARAMS_FILE, ""); |
| 76 | params.ecdhCurve = config.getString(prefix + SSLManager::CFG_ECDH_CURVE, ""); |
| 77 |
nothing calls this directly
no test coverage detected