Attempt to configure/reconfigure TLS. This operation is atomic and will * leave the SSL_CTX unchanged if fails. */
| 280 | * leave the SSL_CTX unchanged if fails. |
| 281 | */ |
| 282 | int tlsConfigure(redisTLSContextConfig *ctx_config) { |
| 283 | char errbuf[256]; |
| 284 | SSL_CTX *ctx = NULL; |
| 285 | SSL_CTX *client_ctx = NULL; |
| 286 | |
| 287 | if (!ctx_config->cert_file) { |
| 288 | serverLog(LL_WARNING, "No tls-cert-file configured!"); |
| 289 | goto error; |
| 290 | } |
| 291 | |
| 292 | if (!ctx_config->key_file) { |
| 293 | serverLog(LL_WARNING, "No tls-key-file configured!"); |
| 294 | goto error; |
| 295 | } |
| 296 | |
| 297 | if (((server.tls_auth_clients != TLS_CLIENT_AUTH_NO) || server.tls_cluster || server.tls_replication) && |
| 298 | !ctx_config->ca_cert_file && !ctx_config->ca_cert_dir) { |
| 299 | serverLog(LL_WARNING, "Either tls-ca-cert-file or tls-ca-cert-dir must be specified when tls-cluster, tls-replication or tls-auth-clients are enabled!"); |
| 300 | goto error; |
| 301 | } |
| 302 | |
| 303 | int protocols = parseProtocolsConfig(ctx_config->protocols); |
| 304 | if (protocols == -1) goto error; |
| 305 | |
| 306 | /* Create server side/generla context */ |
| 307 | ctx = createSSLContext(ctx_config, protocols, 0); |
| 308 | if (!ctx) goto error; |
| 309 | |
| 310 | if (ctx_config->session_caching) { |
| 311 | SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_SERVER); |
| 312 | SSL_CTX_sess_set_cache_size(ctx, ctx_config->session_cache_size); |
| 313 | SSL_CTX_set_timeout(ctx, ctx_config->session_cache_timeout); |
| 314 | SSL_CTX_set_session_id_context(ctx, (void *) "redis", 5); |
| 315 | } else { |
| 316 | SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_OFF); |
| 317 | } |
| 318 | |
| 319 | #ifdef SSL_OP_NO_CLIENT_RENEGOTIATION |
| 320 | SSL_CTX_set_options(ctx, SSL_OP_NO_CLIENT_RENEGOTIATION); |
| 321 | #endif |
| 322 | |
| 323 | if (ctx_config->prefer_server_ciphers) |
| 324 | SSL_CTX_set_options(ctx, SSL_OP_CIPHER_SERVER_PREFERENCE); |
| 325 | |
| 326 | #if defined(SSL_CTX_set_ecdh_auto) |
| 327 | SSL_CTX_set_ecdh_auto(ctx, 1); |
| 328 | #endif |
| 329 | SSL_CTX_set_options(ctx, SSL_OP_SINGLE_DH_USE); |
| 330 | |
| 331 | if (ctx_config->dh_params_file) { |
| 332 | FILE *dhfile = fopen(ctx_config->dh_params_file, "r"); |
| 333 | DH *dh = NULL; |
| 334 | if (!dhfile) { |
| 335 | serverLog(LL_WARNING, "Failed to load %s: %s", ctx_config->dh_params_file, strerror(errno)); |
| 336 | goto error; |
| 337 | } |
| 338 | |
| 339 | dh = PEM_read_DHparams(dhfile, NULL, NULL, NULL); |
no test coverage detected