Repository: valkey-io/valkey
File: src/tls.c (C)

Code before:

    if (!strcasecmp(field, "CN"))
        nid = NID_commonName;
    else if (!strcasecmp(field, "O"))
        nid = NID_organizationName;
    // Add more mappings here as needed

    if (nid == -1) return 0;

    X509_NAME *subject = X509_get_subject_name(cert);
    if (!subject) return 0;

    return X509_NAME_get_text_by_NID(subject, nid, out, outlen) > 0;
}

static void autoAuthenticateClientFromCert(tls_connection *conn) {
    if (!conn || !SSL_is_init_finished(conn->ssl)) return;

    const char *field = server.tls_ctx_config.client_auth_field;
    if (!field) return;

    serverLog(LL_NOTICE, "TLS: Config Auto Auth Field = %s", field);

    X509 *cert = SSL_get_peer_certificate(conn->ssl);
    if (!cert) {
        serverLog(LL_WARNING, "TLS: No peer certificate found after handshake");
        return;
    }

    char field_value[256];
    if (!getCertFieldByName(cert, field, field_value, sizeof(field_value))) {
        serverLog(LL_WARNING, "TLS: Failed to extract field %s from certificate", field);
        X509_free(cert);
        return;
    }

    serverLog(LL_NOTICE, "TLS: Config Auto Auth %s = %s", field, field_value);
    conn->c.cert_user = sdsnew(field_value);
    X509_free(cert);

    client *c = connGetPrivateData(&conn->c);
    if (!c) return;

    user *u = ACLGetUserByName(conn->c.cert_user, sdslen(conn->c.cert_user));
    serverLog(LL_NOTICE, "TLS: ACL lookup user: %s", u ? u->name : "NOT FOUND");
    if (u) {
        c->user = u;
        c->flag.authenticated = true;
        serverLog(LL_NOTICE, "TLS: Auto-authenticated client as %s", u->name);
    }
}

Review comment (suggestion):
WARNING is a serious log level. It means the server is in trouble and needs an administrator's help.

Missing cert is not an error. Client certificate can be configured to be optional. I think we shouldn't log anything here, not even a notice.

Code after:

    int nid = -1;

    if (!strcasecmp(field, "CN"))
        nid = NID_commonName;
    else if (!strcasecmp(field, "O"))
        nid = NID_organizationName;
    /* Add more mappings here as needed */

    if (nid == -1) return 0;

    X509_NAME *subject = X509_get_subject_name(cert);
    if (!subject) return 0;

    return X509_NAME_get_text_by_NID(subject, nid, out, outlen) > 0;
}

sds tlsGetPeerUsername(connection *conn_) {
    tls_connection *conn = (tls_connection *)conn_;
    if (!conn || !SSL_is_init_finished(conn->ssl)) return NULL;

    /* Find the corresponding field name from the enum mapping */
    const char *field = NULL;
    switch (server.tls_ctx_config.client_auth_user) {
    case TLS_CLIENT_FIELD_CN:
        field = "CN";
        break;
    default:
        return NULL;
    }

    if (!field) return NULL;

    X509 *cert = SSL_get_peer_certificate(conn->ssl);
    if (!cert) return NULL;

    char field_value[256];
    sds result = NULL;

    if (getCertFieldByName(cert, field, field_value, sizeof(field_value))) {
        result = sdsnew(field_value);
    } else {
        serverLog(LL_NOTICE, "TLS: Failed to extract field '%s' from certificate", field);
    }

    X509_free(cert);
    return result;
}

static void TLSAccept(void *_conn) {
    tls_connection *conn = (tls_connection *)_conn;