Author: fdmanana
Date: Tue Nov 30 12:22:47 2010
New Revision: 1040490
URL: http://svn.apache.org/viewvc?rev=1040490&view=rev
Log:
Backport COUCHDB-491 into the new replicator (replicator SSL options).
Modified:
couchdb/branches/new_replicator/etc/couchdb/default.ini.tpl.in
couchdb/branches/new_replicator/src/couchdb/couch_api_wrap.hrl
couchdb/branches/new_replicator/src/couchdb/couch_api_wrap_httpc.erl
couchdb/branches/new_replicator/src/couchdb/couch_replicator_utils.erl
Modified: couchdb/branches/new_replicator/etc/couchdb/default.ini.tpl.in
URL:
http://svn.apache.org/viewvc/couchdb/branches/new_replicator/etc/couchdb/default.ini.tpl.in?rev=1040490&r1=1040489&r2=1040490&view=diff
==============================================================================
--- couchdb/branches/new_replicator/etc/couchdb/default.ini.tpl.in (original)
+++ couchdb/branches/new_replicator/etc/couchdb/default.ini.tpl.in Tue Nov 30
12:22:47 2010
@@ -119,4 +119,10 @@ compressible_types = text/*, application
; should be at least 2
worker_processes = 10
; the maximum number of TCP connections to use against a single server
-max_connections_per_server = 100
\ No newline at end of file
+max_connections_per_server = 100
+; set to true to validate peer certificates
+verify_ssl_certificates = false
+; file containing a list of peer trusted certificates (PEM format)
+; ssl_trusted_certificates_file = /etc/ssl/certs/ca-certificates.crt
+; maximum peer certificate depth (must be set even if certificate validation
is off)
+ssl_certificate_max_depth = 3
\ No newline at end of file
Modified: couchdb/branches/new_replicator/src/couchdb/couch_api_wrap.hrl
URL:
http://svn.apache.org/viewvc/couchdb/branches/new_replicator/src/couchdb/couch_api_wrap.hrl?rev=1040490&r1=1040489&r2=1040490&view=diff
==============================================================================
--- couchdb/branches/new_replicator/src/couchdb/couch_api_wrap.hrl (original)
+++ couchdb/branches/new_replicator/src/couchdb/couch_api_wrap.hrl Tue Nov 30
12:22:47 2010
@@ -18,6 +18,7 @@
headers = [],
timeout = 30000, % milliseconds
proxy_options = [],
+ ssl_options = [],
retries = 10,
wait = 250 % milliseconds
}).
Modified: couchdb/branches/new_replicator/src/couchdb/couch_api_wrap_httpc.erl
URL:
http://svn.apache.org/viewvc/couchdb/branches/new_replicator/src/couchdb/couch_api_wrap_httpc.erl?rev=1040490&r1=1040489&r2=1040490&view=diff
==============================================================================
--- couchdb/branches/new_replicator/src/couchdb/couch_api_wrap_httpc.erl
(original)
+++ couchdb/branches/new_replicator/src/couchdb/couch_api_wrap_httpc.erl Tue
Nov 30 12:22:47 2010
@@ -56,7 +56,8 @@ send_req(#httpdb{headers = BaseHeaders}
IbrowseOptions = [
{response_format, binary}, {inactivity_timeout, HttpDb#httpdb.timeout},
{socket_options, [{reuseaddr, true}, {keepalive, true}]}
- | get_value(ibrowse_options, Params, []) ++ HttpDb#httpdb.proxy_options
+ | HttpDb#httpdb.proxy_options ++ HttpDb#httpdb.ssl_options ++
+ get_value(ibrowse_options, Params, [])
],
Headers2 = oauth_header(HttpDb, Params) ++ Headers1,
Url = full_url(HttpDb, Params),
Modified: couchdb/branches/new_replicator/src/couchdb/couch_replicator_utils.erl
URL:
http://svn.apache.org/viewvc/couchdb/branches/new_replicator/src/couchdb/couch_replicator_utils.erl?rev=1040490&r1=1040489&r2=1040490&view=diff
==============================================================================
--- couchdb/branches/new_replicator/src/couchdb/couch_replicator_utils.erl
(original)
+++ couchdb/branches/new_replicator/src/couchdb/couch_replicator_utils.erl Tue
Nov 30 12:22:47 2010
@@ -128,7 +128,8 @@ parse_rep_db({Props}, ProxyParams) ->
url = Url,
oauth = OAuth,
headers = Headers,
- proxy_options = ProxyParams
+ proxy_options = ProxyParams,
+ ssl_options = ssl_params(Url)
};
parse_rep_db(<<"http://";, _/binary>> = Url, ProxyParams) ->
parse_rep_db({[{<<"url">>, Url}]}, ProxyParams);
@@ -189,3 +190,30 @@ parse_proxy_params(ProxyUrl) ->
[{proxy_user, User}, {proxy_password, Passwd}]
end.
+
+ssl_params(Url) ->
+ case ibrowse_lib:parse_url(Url) of
+ #url{protocol = https} ->
+ Depth = list_to_integer(
+ couch_config:get("replicator", "ssl_certificate_max_depth", "3")
+ ),
+ VerifyCerts = couch_config:get("replicator",
"verify_ssl_certificates"),
+ SslOpts = [{depth, Depth} | ssl_verify_options(VerifyCerts =:=
"true")],
+ [{is_ssl, true}, {ssl_options, SslOpts}];
+ #url{protocol = http} ->
+ []
+ end.
+
+ssl_verify_options(Value) ->
+ ssl_verify_options(Value, erlang:system_info(otp_release)).
+
+ssl_verify_options(true, OTPVersion) when OTPVersion >= "R14" ->
+ CAFile = couch_config:get("replicator", "ssl_trusted_certificates_file"),
+ [{verify, verify_peer}, {cacertfile, CAFile}];
+ssl_verify_options(false, OTPVersion) when OTPVersion >= "R14" ->
+ [{verify, verify_none}];
+ssl_verify_options(true, _OTPVersion) ->
+ CAFile = couch_config:get("replicator", "ssl_trusted_certificates_file"),
+ [{verify, 2}, {cacertfile, CAFile}];
+ssl_verify_options(false, _OTPVersion) ->
+ [{verify, 0}].
