xtreemfs/xtreemfs — pull request #347 by robert-schmidtke (2014-11-28 11:16:34+00:00)
Title: Strict ssl

Added command line options:
--verify-certificates : if true (defaults to false), ssl certificate verification is performed
--ignore-verify-errors : list of errors to ignore during ssl certificate verification (defaults to empty list). only used with --verify-certificates true. see https://www.openssl.org/docs/apps/verify.html for a list of errors. e.g. use --ignore-verify-errors 20 27 21 for testing with local untrusted and self-signed certificates.
--pem-trusted-certificates-file-path : path to PEM encoded file of a list of trusted certificates to use during ssl certificate verification. contains the same list of additional certificates as should be included in the PKCS#12 file.
--min-ssl-method : minimum ssl version to accept from server (defaults to sslv23). sslv3 accepts SSLv3 only, sslv23 accepts SSLv2, SSLv3 and TLSv1.x, tlsv1 accepts TLSv1 only. for boost version > 1.53 additionally: tlsv11 accepts TLSv1.1 only, tlsv12 accepts TLSv1.2 only

Always performing certificate validation to allow printing of warnings and errors, only use validation result if --verify-certificates true, otherwise always accept all certificates. Trusted certificates are to be packaged into the PKCS#12 file using the -certfile option, or are to be specified using the --pem-trusted-certificates-file-path option for PEM usage. For PKCS#12 packaged trusted certificates, they are written to a temporary file just like the other certificates and keys. The system path is used in addition to the given trusted certificates for verification. Certain verification errors can be ignored using --ignore-verify-errors or --verify-certificates false.

Printing the SSL/TLS version that was agreed upon between client and server for debugging purposes.

Added unit tests that check PCKS#12 and PEM verification with different cases: no ssl, a one-long certificate chain, a three-long certificate chain, failed verification if used without trusted certificates (short chain), ignoring errors on verification (long chain), no verification but error printing if --verify-certificates false.

Added unit tests that check proper negotiation of SSL/TLS version.

Added new certificates and configurations for these unit tests.

Updated the documentation to reflect new SSL PKCS#12 file creation.

Fixed bug when using OpenJDK 6 and TLS: https://bugs.launchpad.net/ubuntu/+source/openjdk-6/+bug/948875
This had the effect that TLS connections would time out when the servers run OpenJDK 6.

TODOs:
Abort request rather than timeout when client and server cannot agree on SSL version because of different requirements or unimplemented methods, or the protocol was omitted, or required files were not specified.

Fix temporary file useage on Windows (actually used file name is not returned).

Don't expect TLSv1.1 and TLSv1.2 only based on boost version. OpenJDK 6 only supports up to TLSv1. This could lead to failed tests when OpenJDK = 6 and Boost > 1.53.

Add ssl.min_protocol option to services having the same effect of choosing a minimum ssl version.