Unverified Commit be83bb13 authored by Yossi Gottlieb's avatar Yossi Gottlieb Committed by GitHub
Browse files

Add --insecure option to command line tools. (#8416)

Disable certificate validation, making it possible to connect to servers
without configuring full trust chain.

The use of this option is insecure and makes the connection vulnerable
to man in the middle attacks.
parent aea6e71e
...@@ -54,7 +54,7 @@ int cliSecureConnection(redisContext *c, cliSSLconfig config, const char **err) ...@@ -54,7 +54,7 @@ int cliSecureConnection(redisContext *c, cliSSLconfig config, const char **err)
goto error; goto error;
} }
SSL_CTX_set_options(ssl_ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3); SSL_CTX_set_options(ssl_ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3);
SSL_CTX_set_verify(ssl_ctx, SSL_VERIFY_PEER, NULL); SSL_CTX_set_verify(ssl_ctx, config.skip_cert_verify ? SSL_VERIFY_NONE : SSL_VERIFY_PEER, NULL);
if (config.cacert || config.cacertdir) { if (config.cacert || config.cacertdir) {
if (!SSL_CTX_load_verify_locations(ssl_ctx, config.cacert, config.cacertdir)) { if (!SSL_CTX_load_verify_locations(ssl_ctx, config.cacert, config.cacertdir)) {
......
...@@ -10,6 +10,8 @@ typedef struct cliSSLconfig { ...@@ -10,6 +10,8 @@ typedef struct cliSSLconfig {
char *cacert; char *cacert;
/* Directory where trusted CA certificates are stored, or NULL */ /* Directory where trusted CA certificates are stored, or NULL */
char *cacertdir; char *cacertdir;
/* Skip server certificate verification. */
int skip_cert_verify;
/* Client certificate to authenticate with, or NULL */ /* Client certificate to authenticate with, or NULL */
char *cert; char *cert;
/* Private key file to authenticate with, or NULL */ /* Private key file to authenticate with, or NULL */
......
...@@ -1516,6 +1516,8 @@ int parseOptions(int argc, const char **argv) { ...@@ -1516,6 +1516,8 @@ int parseOptions(int argc, const char **argv) {
} else if (!strcmp(argv[i],"--cacert")) { } else if (!strcmp(argv[i],"--cacert")) {
if (lastarg) goto invalid; if (lastarg) goto invalid;
config.sslconfig.cacert = strdup(argv[++i]); config.sslconfig.cacert = strdup(argv[++i]);
} else if (!strcmp(argv[i],"--insecure")) {
config.sslconfig.skip_cert_verify = 1;
} else if (!strcmp(argv[i],"--cert")) { } else if (!strcmp(argv[i],"--cert")) {
if (lastarg) goto invalid; if (lastarg) goto invalid;
config.sslconfig.cert = strdup(argv[++i]); config.sslconfig.cert = strdup(argv[++i]);
...@@ -1585,6 +1587,7 @@ usage: ...@@ -1585,6 +1587,7 @@ usage:
" --cacertdir <dir> Directory where trusted CA certificates are stored.\n" " --cacertdir <dir> Directory where trusted CA certificates are stored.\n"
" If neither cacert nor cacertdir are specified, the default\n" " If neither cacert nor cacertdir are specified, the default\n"
" system-wide trusted root certs configuration will apply.\n" " system-wide trusted root certs configuration will apply.\n"
" --insecure Allow insecure TLS connection by skipping cert validation.\n"
" --cert <file> Client certificate to authenticate with.\n" " --cert <file> Client certificate to authenticate with.\n"
" --key <file> Private key file to authenticate with.\n" " --key <file> Private key file to authenticate with.\n"
" --tls-ciphers <list> Sets the list of prefered ciphers (TLSv1.2 and below)\n" " --tls-ciphers <list> Sets the list of prefered ciphers (TLSv1.2 and below)\n"
...@@ -1682,6 +1685,7 @@ int main(int argc, const char **argv) { ...@@ -1682,6 +1685,7 @@ int main(int argc, const char **argv) {
signal(SIGHUP, SIG_IGN); signal(SIGHUP, SIG_IGN);
signal(SIGPIPE, SIG_IGN); signal(SIGPIPE, SIG_IGN);
memset(&config.sslconfig, 0, sizeof(config.sslconfig));
config.numclients = 50; config.numclients = 50;
config.requests = 100000; config.requests = 100000;
config.liveclients = 0; config.liveclients = 0;
......
...@@ -1695,6 +1695,8 @@ static int parseOptions(int argc, char **argv) { ...@@ -1695,6 +1695,8 @@ static int parseOptions(int argc, char **argv) {
config.sslconfig.key = argv[++i]; config.sslconfig.key = argv[++i];
} else if (!strcmp(argv[i],"--tls-ciphers") && !lastarg) { } else if (!strcmp(argv[i],"--tls-ciphers") && !lastarg) {
config.sslconfig.ciphers = argv[++i]; config.sslconfig.ciphers = argv[++i];
} else if (!strcmp(argv[i],"--insecure")) {
config.sslconfig.skip_cert_verify = 1;
#ifdef TLS1_3_VERSION #ifdef TLS1_3_VERSION
} else if (!strcmp(argv[i],"--tls-ciphersuites") && !lastarg) { } else if (!strcmp(argv[i],"--tls-ciphersuites") && !lastarg) {
config.sslconfig.ciphersuites = argv[++i]; config.sslconfig.ciphersuites = argv[++i];
...@@ -1820,6 +1822,7 @@ static void usage(void) { ...@@ -1820,6 +1822,7 @@ static void usage(void) {
" --cacertdir <dir> Directory where trusted CA certificates are stored.\n" " --cacertdir <dir> Directory where trusted CA certificates are stored.\n"
" If neither cacert nor cacertdir are specified, the default\n" " If neither cacert nor cacertdir are specified, the default\n"
" system-wide trusted root certs configuration will apply.\n" " system-wide trusted root certs configuration will apply.\n"
" --insecure Allow insecure TLS connection by skipping cert validation.\n"
" --cert <file> Client certificate to authenticate with.\n" " --cert <file> Client certificate to authenticate with.\n"
" --key <file> Private key file to authenticate with.\n" " --key <file> Private key file to authenticate with.\n"
" --tls-ciphers <list> Sets the list of prefered ciphers (TLSv1.2 and below)\n" " --tls-ciphers <list> Sets the list of prefered ciphers (TLSv1.2 and below)\n"
...@@ -8131,6 +8134,7 @@ int main(int argc, char **argv) { ...@@ -8131,6 +8134,7 @@ int main(int argc, char **argv) {
int firstarg; int firstarg;
struct timeval tv; struct timeval tv;
memset(&config.sslconfig, 0, sizeof(config.sslconfig));
config.hostip = sdsnew("127.0.0.1"); config.hostip = sdsnew("127.0.0.1");
config.hostport = 6379; config.hostport = 6379;
config.hostsocket = NULL; config.hostsocket = NULL;
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment