mirror of
https://github.com/netdata/netdata.git
synced 2025-04-09 23:57:55 +00:00
2f7962c9e1
* sslstream: ACL parser It was noticed in the issue 6457 that the some ACLs were not parsing correctly when they were along SSL acl, this commit fixes this' * sslstream: remove comments This commit removes the comments that were present while I was testing the code * sslstream: Tests This commit adds ACL tests to check the Netdata response to them * sslstream: Tests Fix the extension to upload the files * sslstream: more tests In this commit I am bringing more tests, including the ssl tests' * sslstream: leading space Remove leading space from variable that was creating problem with shellcheck * sslstream: glob Remove special character from script * sslstream: Makefile The Makefile diretives were pointed to wrong files * sslstream: Missing stream encrypt This commit solves the problem of the stream not be encrypted, but it is not the final solution, because the parser made is incomplete. * sslstream: Finish encrypt channel This commit brings the step that I was missing, the complete encryptation in the communication between Master and Slave * sslstream: Fix argument in script After the latest tests, it was verified that two arguments given to a function inside the script were not correct, with this PR I am fixing this! * sslstream: Fix argument in info Instead to call a function to deliver an integer I was passing a size_t value. Only cmake showed this, but not in my clion! :/ * sslstream: Fix redirect When we were having different SSL configuration, the system were not applying the option for all * sslstream: Update documentation Our documentation was not clear about the rules according our code so I am updating the text to explain for the users * sslstream: Adjust script With this last commit, I am adjusting the tests to avoid false positive * sslstream: Missing elif The previous commit had a missing elif in the shell script * sslstream: Split ports Before this commit Netdata was having SSL as a global option, now it has as a real ACL. * sslstream: reduce context The stream variable will not be affected in the master side, it is only necessary on the slave side, so I am reducing the context of it * sslstream: Force SSL When the user has certificate and he does not set any SSL flag, it is necessary to append the SSL=force flag * sslstream: Default flag It is necessary to have a default flag when the SSL flags are not SET * sslstream: remove comments Remove comments from the scrip * sslstream: moving flag It is better the flag to be set inside socket instead everytime there is a new connection * sslstream: documentation Fix a sentence in the web/server/README.md
45 lines
1.6 KiB
C
45 lines
1.6 KiB
C
#ifndef NETDATA_SECURITY_H
|
|
# define NETDATA_SECURITY_H
|
|
|
|
# define NETDATA_SSL_HANDSHAKE_COMPLETE 0 //All the steps were successful
|
|
# define NETDATA_SSL_START 1 //Starting handshake, conn variable is NULL
|
|
# define NETDATA_SSL_WANT_READ 2 //The connection wanna read from socket
|
|
# define NETDATA_SSL_WANT_WRITE 4 //The connection wanna write on socket
|
|
# define NETDATA_SSL_NO_HANDSHAKE 8 //Continue without encrypt connection.
|
|
# define NETDATA_SSL_OPTIONAL 16 //Flag to define the HTTP request
|
|
# define NETDATA_SSL_FORCE 32 //We only accepts HTTPS request
|
|
# define NETDATA_SSL_INVALID_CERTIFICATE 64 //Accepts invalid certificate
|
|
# define NETDATA_SSL_VALID_CERTIFICATE 128 //Accepts invalid certificate
|
|
|
|
#define NETDATA_SSL_CONTEXT_SERVER 0
|
|
#define NETDATA_SSL_CONTEXT_STREAMING 1
|
|
#define NETDATA_SSL_CONTEXT_OPENTSDB 2
|
|
|
|
# ifdef ENABLE_HTTPS
|
|
|
|
# include <openssl/ssl.h>
|
|
# include <openssl/err.h>
|
|
# if (SSLEAY_VERSION_NUMBER >= 0x0907000L) && (OPENSSL_VERSION_NUMBER < 0x10100000L)
|
|
# include <openssl/conf.h>
|
|
# endif
|
|
|
|
struct netdata_ssl{
|
|
SSL *conn; //SSL connection
|
|
int flags; //The flags for SSL connection
|
|
};
|
|
|
|
extern SSL_CTX *netdata_opentsdb_ctx;
|
|
extern SSL_CTX *netdata_client_ctx;
|
|
extern SSL_CTX *netdata_srv_ctx;
|
|
extern const char *security_key;
|
|
extern const char *security_cert;
|
|
extern int netdata_validate_server;
|
|
|
|
void security_openssl_library();
|
|
void security_clean_openssl();
|
|
void security_start_ssl(int selector);
|
|
int security_process_accept(SSL *ssl,int msg);
|
|
int security_test_certificate(SSL *ssl);
|
|
|
|
# endif //ENABLE_HTTPS
|
|
#endif //NETDATA_SECURITY_H
|