Wrapper around redisSecureConnection to avoid hiredis_ssl dependencies if * not building with TLS support. */
| 44 | * not building with TLS support. |
| 45 | */ |
| 46 | int cliSecureConnection(redisContext *c, cliSSLconfig config, const char **err) { |
| 47 | #ifdef USE_OPENSSL |
| 48 | static SSL_CTX *ssl_ctx = NULL; |
| 49 | |
| 50 | if (!ssl_ctx) { |
| 51 | ssl_ctx = SSL_CTX_new(SSLv23_client_method()); |
| 52 | if (!ssl_ctx) { |
| 53 | *err = "Failed to create SSL_CTX"; |
| 54 | goto error; |
| 55 | } |
| 56 | SSL_CTX_set_options(ssl_ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3); |
| 57 | SSL_CTX_set_verify(ssl_ctx, config.skip_cert_verify ? SSL_VERIFY_NONE : SSL_VERIFY_PEER, NULL); |
| 58 | |
| 59 | if (config.cacert || config.cacertdir) { |
| 60 | if (!SSL_CTX_load_verify_locations(ssl_ctx, config.cacert, config.cacertdir)) { |
| 61 | *err = "Invalid CA Certificate File/Directory"; |
| 62 | goto error; |
| 63 | } |
| 64 | } else { |
| 65 | if (!SSL_CTX_set_default_verify_paths(ssl_ctx)) { |
| 66 | *err = "Failed to use default CA paths"; |
| 67 | goto error; |
| 68 | } |
| 69 | } |
| 70 | |
| 71 | if (config.cert && !SSL_CTX_use_certificate_chain_file(ssl_ctx, config.cert)) { |
| 72 | *err = "Invalid client certificate"; |
| 73 | goto error; |
| 74 | } |
| 75 | |
| 76 | if (config.key && !SSL_CTX_use_PrivateKey_file(ssl_ctx, config.key, SSL_FILETYPE_PEM)) { |
| 77 | *err = "Invalid private key"; |
| 78 | goto error; |
| 79 | } |
| 80 | if (config.ciphers && !SSL_CTX_set_cipher_list(ssl_ctx, config.ciphers)) { |
| 81 | *err = "Error while configuring ciphers"; |
| 82 | goto error; |
| 83 | } |
| 84 | #ifdef TLS1_3_VERSION |
| 85 | if (config.ciphersuites && !SSL_CTX_set_ciphersuites(ssl_ctx, config.ciphersuites)) { |
| 86 | *err = "Error while setting cypher suites"; |
| 87 | goto error; |
| 88 | } |
| 89 | #endif |
| 90 | } |
| 91 | |
| 92 | SSL *ssl = SSL_new(ssl_ctx); |
| 93 | if (!ssl) { |
| 94 | *err = "Failed to create SSL object"; |
| 95 | return REDIS_ERR; |
| 96 | } |
| 97 | |
| 98 | if (config.sni && !SSL_set_tlsext_host_name(ssl, config.sni)) { |
| 99 | *err = "Failed to configure SNI"; |
| 100 | SSL_free(ssl); |
| 101 | return REDIS_ERR; |
| 102 | } |
| 103 |
no test coverage detected