summaryrefslogtreecommitdiffstats
path: root/glusterfsd
diff options
context:
space:
mode:
authorMohit Agrawal <moagrawa@redhat.com>2018-03-14 09:37:52 +0530
committerJeff Darcy <jeff@pl.atyp.us>2018-03-19 19:00:03 +0000
commitcf06dd544004701ef43fa81c5b7a95353d5c1d65 (patch)
tree7f52598cb402269c781d020686886bf28c481232 /glusterfsd
parentde52876407040a8cae9656ede9f66084d4cb45ac (diff)
glusterd: TLS verification fails while using intermediate CA
Problem: TLS verification fails while using intermediate CA if mgmt SSL is enabled. Solution: There are two main issue of TLS verification failing 1) not calling ssl_api to set cert_depth 2) The current code does not allow to set certificate depth while MGMT SSL is enabled. After apply this patch to set certificate depth user need to set parameter option transport.socket.ssl-cert-depth <depth> in /var/lib/glusterd/secure_acccess instead to set in /etc/glusterfs/glusterd.vol. At the time of set secure_mgmt in ctx we will check the value of cert-depth and save the value of cert-depth in ctx.If user does not provide any value in cert-depth in that case it will consider default value is 1 BUG: 1555154 Change-Id: I89e9a9e1026e37efb5c20f9ec62b1989ef644f35 Signed-off-by: Mohit Agrawal <moagrawa@redhat.com>
Diffstat (limited to 'glusterfsd')
-rw-r--r--glusterfsd/src/glusterfsd-mgmt.c2
-rw-r--r--glusterfsd/src/glusterfsd.c1
2 files changed, 3 insertions, 0 deletions
diff --git a/glusterfsd/src/glusterfsd-mgmt.c b/glusterfsd/src/glusterfsd-mgmt.c
index bf55a0770b4..d2b39494e51 100644
--- a/glusterfsd/src/glusterfsd-mgmt.c
+++ b/glusterfsd/src/glusterfsd-mgmt.c
@@ -2650,6 +2650,8 @@ glusterfs_mgmt_init (glusterfs_ctx_t *ctx)
goto out;
}
+
+ ctx->ssl_cert_depth = glusterfs_read_secure_access_file ();
}
rpc = rpc_clnt_new (options, THIS, THIS->name, 8);
diff --git a/glusterfsd/src/glusterfsd.c b/glusterfsd/src/glusterfsd.c
index 0cc46c78943..ef06ddfed31 100644
--- a/glusterfsd/src/glusterfsd.c
+++ b/glusterfsd/src/glusterfsd.c
@@ -1951,6 +1951,7 @@ parse_cmdline (int argc, char *argv[], glusterfs_ctx_t *ctx)
/* Do this before argp_parse so it can be overridden. */
if (sys_access (SECURE_ACCESS_FILE, F_OK) == 0) {
cmd_args->secure_mgmt = 1;
+ ctx->ssl_cert_depth = glusterfs_read_secure_access_file ();
}
argp_parse (&argp, argc, argv, ARGP_IN_ORDER, NULL, cmd_args);