Many hyperlinks are disabled.
Use anonymous login
to enable hyperlinks.
Overview
| Comment: | tls: fix reading a loaded cert to be used with fossil server --tls repo.fossil talked about in forum thread https://fossil-scm.org/forum/forumpost/46f7dfc63f |
|---|---|
| Downloads: | Tarball | ZIP archive |
| Timelines: | family | ancestors | descendants | both | tls-server-fix |
| Files: | files | file ages | folders |
| SHA3-256: |
81c486badfaa806b6bd00bdf62ab1b7f |
| User & Date: | rdb 2022-01-15 16:44:32.457 |
| Original Comment: | tls: fix reading a loaded cert to be used with fossil server --tls repo.fossil |
Context
|
2022-01-15
| ||
| 16:49 | add FOSSIL_ENABLE_SSL guards to new code ... (check-in: 9c68e9f8ca user: rdb tags: tls-server-fix) | |
| 16:44 | tls: fix reading a loaded cert to be used with fossil server --tls repo.fossil talked about in forum thread https://fossil-scm.org/forum/forumpost/46f7dfc63f ... (check-in: 81c486badf user: rdb tags: tls-server-fix) | |
| 08:33 | tls: fixes fossil ssl-config load-cert --filename so that the cert and keys are combined and stored in the config table. fossil ui --tls and fossil server --tls now reads the certificate from the config table field ssl-cert. ... (check-in: c2562490d4 user: rdb tags: tls-server-fix) | |
Changes
Changes to src/main.c.
| ︙ | ︙ | |||
2587 2588 2589 2590 2591 2592 2593 2594 2595 2596 2597 2598 2599 2600 2601 2602 2603 |
return;
}
}
}
#endif
@ %d(GETPID())
}
/*
** Check for options to "fossil server" or "fossil ui" that imply that
** SSL should be used, and initialize the SSL decoder.
*/
static void decode_ssl_options(void){
#if FOSSIL_ENABLE_SSL
const char *zCertFile = 0;
zCertFile = find_option("tls-cert-file",0,1);
if( zCertFile ){
| > > > > > > > > > > > > > > > > < | < | | 2587 2588 2589 2590 2591 2592 2593 2594 2595 2596 2597 2598 2599 2600 2601 2602 2603 2604 2605 2606 2607 2608 2609 2610 2611 2612 2613 2614 2615 2616 2617 2618 2619 2620 2621 2622 2623 2624 2625 2626 2627 2628 2629 2630 |
return;
}
}
}
#endif
@ %d(GETPID())
}
/*
** Initialize the SSL decoder.
*/
static void init_ssl_decoder(const char *zCertFile, int tls){
#if FOSSIL_ENABLE_SSL
if( zCertFile ){
g.httpUseSSL = 1;
ssl_init_server(zCertFile, zCertFile);
}
if( 1 == tls ){
g.httpUseSSL = 1;
ssl_init_server(0,0);
}
#endif
}
/*
** Check for options to "fossil server" or "fossil ui" that imply that
** SSL should be used, and initialize the SSL decoder.
*/
static void decode_ssl_options(void){
#if FOSSIL_ENABLE_SSL
const char *zCertFile = 0;
zCertFile = find_option("tls-cert-file",0,1);
if( zCertFile ){
init_ssl_decoder(zCertFile, 0);
}
if( find_option("tls",0,0)!=0 || find_option("ssl",0,0)!=0 ){
init_ssl_decoder(0, 1);
}
#endif
}
/*
** COMMAND: http*
**
|
| ︙ | ︙ | |||
3047 3048 3049 3050 3051 3052 3053 | int fCreate = 0; /* The --create flag */ int fNoBrowser = 0; /* Do not auto-launch web-browser */ const char *zInitPage = 0; /* Start on this page. --page option */ int findServerArg = 2; /* argv index for find_server_repository() */ char *zRemote = 0; /* Remote host on which to run "fossil ui" */ const char *zJsMode; /* The --jsmode parameter */ const char *zFossilCmd =0; /* Name of "fossil" binary on remote system */ | | | > > | 3061 3062 3063 3064 3065 3066 3067 3068 3069 3070 3071 3072 3073 3074 3075 3076 3077 3078 |
int fCreate = 0; /* The --create flag */
int fNoBrowser = 0; /* Do not auto-launch web-browser */
const char *zInitPage = 0; /* Start on this page. --page option */
int findServerArg = 2; /* argv index for find_server_repository() */
char *zRemote = 0; /* Remote host on which to run "fossil ui" */
const char *zJsMode; /* The --jsmode parameter */
const char *zFossilCmd =0; /* Name of "fossil" binary on remote system */
#if FOSSIL_ENABLE_SSL
const char *zCertFile =0; /* Internal - TLS/SSL cert filename of the --tls-cert-file option */
int zTls =0; /* Internal - 1 = use a TLS/SSL cert that has been previously loaded by ssl-config load-cert command or 0 if no TLS / SSL has been loaeded */
#endif
#if defined(_WIN32)
const char *zStopperFile; /* Name of file used to terminate server */
zStopperFile = find_option("stopper", 0, 1);
#endif
if( g.zErrlog==0 ){
g.zErrlog = "-";
|
| ︙ | ︙ | |||
3094 3095 3096 3097 3098 3099 3100 |
fCreate = find_option("create",0,0)!=0;
if( find_option("scgi", 0, 0)!=0 ) flags |= HTTP_SERVER_SCGI;
if( zAltBase ){
set_base_url(zAltBase);
}
g.sslNotAvailable = find_option("nossl", 0, 0)!=0 || isUiCmd;
fNoBrowser = find_option("nobrowser", 0, 0)!=0;
| | > > > | | > > > > > | 3110 3111 3112 3113 3114 3115 3116 3117 3118 3119 3120 3121 3122 3123 3124 3125 3126 3127 3128 3129 3130 3131 3132 3133 3134 3135 |
fCreate = find_option("create",0,0)!=0;
if( find_option("scgi", 0, 0)!=0 ) flags |= HTTP_SERVER_SCGI;
if( zAltBase ){
set_base_url(zAltBase);
}
g.sslNotAvailable = find_option("nossl", 0, 0)!=0 || isUiCmd;
fNoBrowser = find_option("nobrowser", 0, 0)!=0;
/*
** get tls / ssl options, the calls that use these options need
** access to the repo database which has not been found yet.
** we get and store them now, as find_option removes them from
** argv
*/
zCertFile = find_option("tls-cert-file",0,1);
if( find_option("tls",0,0)!=0 || find_option("ssl",0,0)!=0 ){
zTls = 1;
}
if( find_option("localhost", 0, 0)!=0 ){
flags |= HTTP_SERVER_LOCALHOST;
}
g.zCkoutAlias = find_option("ckout-alias",0,1);
g.zMainMenuFile = find_option("mainmenu",0,1);
if( g.zMainMenuFile!=0 && file_size(g.zMainMenuFile,ExtFILE)<0 ){
fossil_fatal("Cannot read --mainmenu file %s", g.zMainMenuFile);
|
| ︙ | ︙ | |||
3125 3126 3127 3128 3129 3130 3131 |
zTimeout = "100000000";
#endif
}
/* We should be done with options.. */
verify_all_options();
if( g.argc!=2 && g.argc!=3 ) usage("?REPOSITORY?");
| < < < | 3149 3150 3151 3152 3153 3154 3155 3156 3157 3158 3159 3160 3161 3162 |
zTimeout = "100000000";
#endif
}
/* We should be done with options.. */
verify_all_options();
if( g.argc!=2 && g.argc!=3 ) usage("?REPOSITORY?");
if( isUiCmd && 3==g.argc && file_isdir(g.argv[2], ExtFILE)>0 ){
/* If REPOSITORY arg is the root of a checkout,
** chdir to that checkout so that the current version
** gets highlighted in the timeline by default. */
const char * zDir = g.argv[2];
if(dir_has_ckout_db(zDir)){
if(0!=file_chdir(zDir, 0)){
|
| ︙ | ︙ | |||
3164 3165 3166 3167 3168 3169 3170 3171 3172 3173 3174 3175 3176 3177 |
flags |= HTTP_SERVER_LOCALHOST|HTTP_SERVER_REPOLIST;
g.useLocalauth = 1;
allowRepoList = 1;
}
if( !zRemote ){
find_server_repository(findServerArg, fCreate);
}
if( zInitPage==0 ){
if( isUiCmd && g.localOpen ){
zInitPage = "timeline?c=current";
}else{
zInitPage = "";
}
}
| > > > > > > > > > > > > > > | 3185 3186 3187 3188 3189 3190 3191 3192 3193 3194 3195 3196 3197 3198 3199 3200 3201 3202 3203 3204 3205 3206 3207 3208 3209 3210 3211 3212 |
flags |= HTTP_SERVER_LOCALHOST|HTTP_SERVER_REPOLIST;
g.useLocalauth = 1;
allowRepoList = 1;
}
if( !zRemote ){
find_server_repository(findServerArg, fCreate);
}
/*
** We need call enable TLS / SSL here as we need query the
** repo database to access the certificate if its been loaded
**
** The database has only just been found and made available
*/
init_ssl_decoder(zCertFile, zTls);
if( find_option("https",0,0)!=0 || g.httpUseSSL ){
cgi_replace_parameter("HTTPS","on");
}
if( g.httpUseSSL && (flags & HTTP_SERVER_SCGI)!=0 ){
fossil_fatal("SCGI does not (yet) support TLS-encrypted connections");
}
if( zInitPage==0 ){
if( isUiCmd && g.localOpen ){
zInitPage = "timeline?c=current";
}else{
zInitPage = "";
}
}
|
| ︙ | ︙ |