1
0
Fork 0

added --server.ssl-protocol option for client tools

Conflicts:
	arangosh/Benchmark/BenchmarkThread.h
	lib/GeneralServer/SslAsyncCommTask.h
This commit is contained in:
Jan Steemann 2013-12-13 17:53:51 +01:00
parent 3f1ffd2d70
commit 7c4944de83
33 changed files with 161 additions and 34 deletions

View File

@ -101,6 +101,12 @@ v1.5.x (XXXX-XX-XX)
v1.4.x (XXXX-XX-XX)
-------------------
* added `--server.ssl-protocol` option for client tools
this allows connecting from arangosh, arangoimp, arangoimp etc. to an ArangoDB
server that uses a non-default value for `--server.ssl-protocol`. The default
value for the SSL protocol is 4 (TLSv1). If the server is configured to use a
different protocol, it was not possible to connect to it with the client tools.
* added more detailed request statistics
This adds the number of async-executed HTTP requests plus the number of HTTP

View File

@ -120,7 +120,8 @@ Syncer::Syncer (TRI_vocbase_t* vocbase,
_connection = GeneralClientConnection::factory(_endpoint,
_configuration._requestTimeout,
_configuration._connectTimeout,
(size_t) _configuration._maxConnectRetries);
(size_t) _configuration._maxConnectRetries,
(uint32_t) _configuration._sslProtocol);
if (_connection != 0) {
_client = new SimpleHttpClient(_connection, _configuration._requestTimeout, false);
@ -303,7 +304,7 @@ int Syncer::applyCollectionDumpMarker (TRI_transaction_collection_t* trxCollecti
}
if (res == TRI_ERROR_NO_ERROR) {
res = primary->insert(trxCollection, key, rid, &mptr, TRI_DOC_MARKER_KEY_EDGE, shaped, &edge, false, false);
res = primary->insert(trxCollection, key, rid, &mptr, TRI_DOC_MARKER_KEY_EDGE, shaped, &edge, false, false, true);
}
}
else {
@ -312,7 +313,7 @@ int Syncer::applyCollectionDumpMarker (TRI_transaction_collection_t* trxCollecti
res = TRI_ERROR_ARANGO_COLLECTION_TYPE_INVALID;
}
else {
res = primary->insert(trxCollection, key, rid, &mptr, TRI_DOC_MARKER_KEY_DOCUMENT, shaped, 0, false, false);
res = primary->insert(trxCollection, key, rid, &mptr, TRI_DOC_MARKER_KEY_DOCUMENT, shaped, 0, false, false, true);
}
}
}

View File

@ -1962,7 +1962,7 @@ int RestReplicationHandler::applyCollectionDumpMarker (CollectionNameResolver co
}
if (res == TRI_ERROR_NO_ERROR) {
res = primary->insert(trxCollection, key, rid, &mptr, TRI_DOC_MARKER_KEY_EDGE, shaped, &edge, false, false);
res = primary->insert(trxCollection, key, rid, &mptr, TRI_DOC_MARKER_KEY_EDGE, shaped, &edge, false, false, true);
}
}
else {
@ -1971,7 +1971,7 @@ int RestReplicationHandler::applyCollectionDumpMarker (CollectionNameResolver co
res = TRI_ERROR_ARANGO_COLLECTION_TYPE_INVALID;
}
else {
res = primary->insert(trxCollection, key, rid, &mptr, TRI_DOC_MARKER_KEY_DOCUMENT, shaped, 0, false, false);
res = primary->insert(trxCollection, key, rid, &mptr, TRI_DOC_MARKER_KEY_DOCUMENT, shaped, 0, false, false, true);
}
}
}
@ -2959,6 +2959,7 @@ void RestReplicationHandler::handleCommandApplierSetConfig () {
config._connectTimeout = JsonHelper::getNumericValue<double>(json, "connectTimeout", config._connectTimeout);
config._ignoreErrors = JsonHelper::getNumericValue<uint64_t>(json, "ignoreErrors", config._ignoreErrors);
config._maxConnectRetries = JsonHelper::getNumericValue<uint64_t>(json, "maxConnectRetries", config._maxConnectRetries);
config._sslProtocol = JsonHelper::getNumericValue<uint32_t>(json, "sslProtocol", config._sslProtocol);
config._chunkSize = JsonHelper::getNumericValue<uint64_t>(json, "chunkSize", config._chunkSize);
config._autoStart = JsonHelper::getBooleanValue(json, "autoStart", config._autoStart);
config._adaptivePolling = JsonHelper::getBooleanValue(json, "adaptivePolling", config._adaptivePolling);

View File

@ -848,7 +848,8 @@ namespace triagens {
shaped,
data,
! isLocked(trxCollection, TRI_TRANSACTION_WRITE),
forceSync);
forceSync,
false);
return res;
}

View File

@ -3593,6 +3593,12 @@ static v8::Handle<v8::Value> JS_ConfigureApplierReplication (v8::Arguments const
}
}
if (object->Has(TRI_V8_SYMBOL("sslProtocol"))) {
if (object->Get(TRI_V8_SYMBOL("sslProtocol"))->IsNumber()) {
config._sslProtocol = (uint32_t) TRI_ObjectToUInt64(object->Get(TRI_V8_SYMBOL("sslProtocol")), false);
}
}
if (object->Has(TRI_V8_SYMBOL("chunkSize"))) {
if (object->Get(TRI_V8_SYMBOL("chunkSize"))->IsNumber()) {
config._chunkSize = TRI_ObjectToUInt64(object->Get(TRI_V8_SYMBOL("chunkSize")), true);

View File

@ -439,7 +439,8 @@ static int CreateDocumentMarker (TRI_primary_collection_t* primary,
const TRI_df_marker_type_e markerType,
TRI_voc_key_t key,
TRI_shaped_json_t const* shaped,
void const* data) {
void const* data,
bool isRestore) {
char* mem;
TRI_doc_document_key_marker_t* marker;
TRI_key_generator_t* keyGenerator;
@ -468,7 +469,8 @@ static int CreateDocumentMarker (TRI_primary_collection_t* primary,
tick,
key,
(char*) &keyBuffer,
&keySize);
&keySize,
isRestore);
if (res != TRI_ERROR_NO_ERROR) {
// key generation failed
@ -1583,7 +1585,8 @@ static int InsertShapedJson (TRI_transaction_collection_t* trxCollection,
TRI_shaped_json_t const* shaped,
void const* data,
const bool lock,
const bool forceSync) {
const bool forceSync,
const bool isRestore) {
TRI_primary_collection_t* primary;
TRI_doc_document_key_marker_t* marker;
@ -1611,7 +1614,8 @@ static int InsertShapedJson (TRI_transaction_collection_t* trxCollection,
markerType,
key,
shaped,
data);
data,
isRestore);
if (res != TRI_ERROR_NO_ERROR) {
return res;

View File

@ -232,7 +232,8 @@ static int TraditionalGenerate (TRI_key_generator_t* const generator,
const TRI_voc_tick_t tick,
const char* const userKey,
char* const outBuffer,
size_t* const outLength) {
size_t* const outLength,
bool isRestore) {
traditional_keygen_t* data;
char* current;
@ -245,7 +246,7 @@ static int TraditionalGenerate (TRI_key_generator_t* const generator,
size_t userKeyLength;
// user has specified a key
if (! data->_allowUserKeys) {
if (! data->_allowUserKeys && ! isRestore) {
// we do not allow user-generated keys
return TRI_ERROR_ARANGO_DOCUMENT_KEY_UNEXPECTED;
}
@ -475,7 +476,8 @@ static int AutoIncrementGenerate (TRI_key_generator_t* const generator,
const TRI_voc_tick_t tick,
const char* const userKey,
char* const outBuffer,
size_t* const outLength) {
size_t* const outLength,
bool isRestore) {
autoincrement_keygen_t* data;
char* current;
@ -489,7 +491,7 @@ static int AutoIncrementGenerate (TRI_key_generator_t* const generator,
size_t userKeyLength;
// user has specified a key
if (! data->_allowUserKeys) {
if (! data->_allowUserKeys && ! isRestore) {
// we do not allow user-generated keys
return TRI_ERROR_ARANGO_DOCUMENT_KEY_UNEXPECTED;
}

View File

@ -78,7 +78,7 @@ typedef struct TRI_key_generator_s {
void* _data;
int (*init)(struct TRI_key_generator_s* const, const struct TRI_json_s* const);
int (*generate)(struct TRI_key_generator_s* const, const size_t, const TRI_voc_tick_t, const char* const, char* const, size_t* const);
int (*generate)(struct TRI_key_generator_s* const, const size_t, const TRI_voc_tick_t, const char* const, char* const, size_t* const, bool);
void (*track)(struct TRI_key_generator_s* const, const TRI_voc_key_t);
void (*free)(struct TRI_key_generator_s* const);
struct TRI_json_s* (*toJson)(const struct TRI_key_generator_s* const);

View File

@ -326,7 +326,7 @@ typedef struct TRI_primary_collection_s {
#endif
int (*notifyTransaction) (struct TRI_primary_collection_s*, TRI_transaction_status_e);
int (*insert) (struct TRI_transaction_collection_s*, const TRI_voc_key_t, TRI_voc_rid_t, TRI_doc_mptr_t*, TRI_df_marker_type_e, TRI_shaped_json_t const*, void const*, const bool, const bool);
int (*insert) (struct TRI_transaction_collection_s*, const TRI_voc_key_t, TRI_voc_rid_t, TRI_doc_mptr_t*, TRI_df_marker_type_e, TRI_shaped_json_t const*, void const*, const bool, const bool, const bool);
int (*read) (struct TRI_transaction_collection_s*, const TRI_voc_key_t, TRI_doc_mptr_t*, const bool);

View File

@ -173,6 +173,11 @@ static TRI_json_t* JsonConfiguration (TRI_replication_applier_configuration_t co
json,
"maxConnectRetries",
TRI_CreateNumberJson(TRI_CORE_MEM_ZONE, (double) config->_maxConnectRetries));
TRI_Insert3ArrayJson(TRI_CORE_MEM_ZONE,
json,
"sslProtocol",
TRI_CreateNumberJson(TRI_CORE_MEM_ZONE, (double) config->_sslProtocol));
TRI_Insert3ArrayJson(TRI_CORE_MEM_ZONE,
json,
@ -304,6 +309,12 @@ static int LoadConfiguration (TRI_vocbase_t* vocbase,
config->_maxConnectRetries = (uint64_t) value->_value._number;
}
value = TRI_LookupArrayJson(json, "sslProtocol");
if (TRI_IsNumberJson(value)) {
config->_sslProtocol = (uint32_t) value->_value._number;
}
value = TRI_LookupArrayJson(json, "chunkSize");
if (TRI_IsNumberJson(value)) {
@ -1184,6 +1195,7 @@ void TRI_InitConfigurationReplicationApplier (TRI_replication_applier_configurat
config->_requestTimeout = 300.0;
config->_connectTimeout = 10.0;
config->_maxConnectRetries = 100;
config->_sslProtocol = 0;
config->_autoStart = false;
config->_chunkSize = 0;
config->_adaptivePolling = true;
@ -1253,6 +1265,7 @@ void TRI_CopyConfigurationReplicationApplier (TRI_replication_applier_configurat
dst->_connectTimeout = src->_connectTimeout;
dst->_ignoreErrors = src->_ignoreErrors;
dst->_maxConnectRetries = src->_maxConnectRetries;
dst->_sslProtocol = src->_sslProtocol;
dst->_chunkSize = src->_chunkSize;
dst->_autoStart = src->_autoStart;
dst->_adaptivePolling = src->_adaptivePolling;

View File

@ -74,6 +74,7 @@ typedef struct TRI_replication_applier_configuration_s {
uint64_t _ignoreErrors;
uint64_t _maxConnectRetries;
uint64_t _chunkSize;
uint32_t _sslProtocol;
bool _autoStart;
bool _adaptivePolling;
}

View File

@ -525,7 +525,8 @@ static int LogEvent (TRI_replication_logger_t* logger,
shaped,
NULL,
isStandaloneOperation,
forceSync);
forceSync,
false);
TRI_FreeShapedJson(zone, shaped);

View File

@ -440,6 +440,7 @@ static int InsertTrxCallback (TRI_transaction_collection_t* trxCollection,
shaped,
NULL,
false,
false,
false);
TRI_FreeShapedJson(zone, shaped);

View File

@ -78,7 +78,8 @@ MRubyClientConnection::MRubyClientConnection (mrb_state* mrb,
_client(0),
_httpResult(0) {
_connection = GeneralClientConnection::factory(endpoint, connectionTimeout, requestTimeout, numRetries);
_connection = GeneralClientConnection::factory(endpoint, connectionTimeout, requestTimeout, numRetries, 0);
if (_connection == 0) {
throw "out of memory";
}

View File

@ -110,7 +110,8 @@ ArangoClient::ArangoClient ()
_password(""),
_hasPassword(false),
_connectTimeout(DEFAULT_CONNECTION_TIMEOUT),
_requestTimeout(DEFAULT_REQUEST_TIMEOUT) {
_requestTimeout(DEFAULT_REQUEST_TIMEOUT),
_sslProtocol(4) {
char* p = TRI_GetTempPath();
@ -241,6 +242,7 @@ void ArangoClient::setupServer (ProgramOptionsDescription& description) {
("server.password", &_password, "password to use when connecting. Don't specify this option to get a password prompt")
("server.connect-timeout", &_connectTimeout, "connect timeout in seconds")
("server.request-timeout", &_requestTimeout, "request timeout in seconds")
("server.ssl-protocol", &_sslProtocol, "1 = SSLv2, 2 = SSLv23, 3 = SSLv3, 4 = TLSv1")
;
description(clientOptions, false);
@ -827,6 +829,14 @@ double ArangoClient::requestTimeout () const {
return _requestTimeout;
}
////////////////////////////////////////////////////////////////////////////////
/// @brief ssl protocol
////////////////////////////////////////////////////////////////////////////////
uint32_t ArangoClient::sslProtocol () const {
return _sslProtocol;
}
// -----------------------------------------------------------------------------
// --SECTION-- END-OF-FILE
// -----------------------------------------------------------------------------

View File

@ -415,6 +415,12 @@ namespace triagens {
double requestTimeout () const;
////////////////////////////////////////////////////////////////////////////////
/// @brief ssl protocol
////////////////////////////////////////////////////////////////////////////////
uint32_t sslProtocol () const;
////////////////////////////////////////////////////////////////////////////////
/// @}
////////////////////////////////////////////////////////////////////////////////
@ -589,6 +595,12 @@ namespace triagens {
////////////////////////////////////////////////////////////////////////////////
double _requestTimeout;
////////////////////////////////////////////////////////////////////////////////
/// @brief ssl protocol
////////////////////////////////////////////////////////////////////////////////
uint32_t _sslProtocol;
};
}
}

View File

@ -83,6 +83,7 @@ namespace triagens {
const string& password,
double requestTimeout,
double connectTimeout,
uint32_t sslProtocol,
bool keepAlive,
bool async)
: Thread("arangob"),
@ -100,6 +101,7 @@ namespace triagens {
_password(password),
_requestTimeout(requestTimeout),
_connectTimeout(connectTimeout),
_sslProtocol(sslProtocol),
_keepAlive(keepAlive),
_async(async),
_client(0),
@ -145,7 +147,7 @@ namespace triagens {
////////////////////////////////////////////////////////////////////////////////
virtual void run () {
_connection = GeneralClientConnection::factory(_endpoint, _requestTimeout, _connectTimeout, 3);
_connection = GeneralClientConnection::factory(_endpoint, _requestTimeout, _connectTimeout, 3, _sslProtocol);
if (_connection == 0) {
LOG_FATAL_AND_EXIT("out of memory");
@ -527,6 +529,12 @@ namespace triagens {
double _connectTimeout;
////////////////////////////////////////////////////////////////////////////////
/// @brief ssl protocol
////////////////////////////////////////////////////////////////////////////////
uint32_t _sslProtocol;
////////////////////////////////////////////////////////////////////////////////
/// @brief use HTTP keep-alive
////////////////////////////////////////////////////////////////////////////////

View File

@ -379,6 +379,7 @@ int main (int argc, char* argv[]) {
BaseClient.password(),
BaseClient.requestTimeout(),
BaseClient.connectTimeout(),
BaseClient.sslProtocol(),
KeepAlive,
Async);

View File

@ -62,6 +62,7 @@ V8ClientConnection::V8ClientConnection (Endpoint* endpoint,
double requestTimeout,
double connectTimeout,
size_t numRetries,
uint32_t sslProtocol,
bool warn)
: _connection(0),
_databaseName(databaseName),
@ -71,7 +72,7 @@ V8ClientConnection::V8ClientConnection (Endpoint* endpoint,
_httpResult(0) {
_connection = GeneralClientConnection::factory(endpoint, requestTimeout, connectTimeout, numRetries);
_connection = GeneralClientConnection::factory(endpoint, requestTimeout, connectTimeout, numRetries, sslProtocol);
if (_connection == 0) {
throw "out of memory";

View File

@ -83,6 +83,7 @@ namespace triagens {
double,
double,
size_t,
uint32_t,
bool);
////////////////////////////////////////////////////////////////////////////////

View File

@ -890,7 +890,8 @@ int main (int argc, char* argv[]) {
Connection = GeneralClientConnection::factory(BaseClient.endpointServer(),
BaseClient.requestTimeout(),
BaseClient.connectTimeout(),
ArangoClient::DEFAULT_RETRIES);
ArangoClient::DEFAULT_RETRIES,
BaseClient.sslProtocol());
if (Connection == 0) {
cerr << "out of memory" << endl;

View File

@ -300,6 +300,7 @@ int main (int argc, char* argv[]) {
BaseClient.requestTimeout(),
BaseClient.connectTimeout(),
ArangoClient::DEFAULT_RETRIES,
BaseClient.sslProtocol(),
false);
if (! ClientConnection->isConnected() || ClientConnection->getLastHttpReturnCode() != HttpResponse::OK) {

View File

@ -884,7 +884,8 @@ int main (int argc, char* argv[]) {
Connection = GeneralClientConnection::factory(BaseClient.endpointServer(),
BaseClient.requestTimeout(),
BaseClient.connectTimeout(),
ArangoClient::DEFAULT_RETRIES);
ArangoClient::DEFAULT_RETRIES,
BaseClient.sslProtocol());
if (Connection == 0) {
cerr << "out of memory" << endl;

View File

@ -424,6 +424,7 @@ static V8ClientConnection* CreateConnection () {
BaseClient.requestTimeout(),
BaseClient.connectTimeout(),
ArangoClient::DEFAULT_RETRIES,
BaseClient.sslProtocol(),
false);
}

View File

@ -131,7 +131,8 @@ static V8ClientConnection* CreateConnection (Endpoint* endpoint) {
300, // request timeout
3, // connection timeout
3, // retries
false);
false,
0);
}
// -----------------------------------------------------------------------------

View File

@ -119,6 +119,9 @@
increment: 42
}
});
for (i = 0; i < 1000; ++i) {
c.save({ value: i, more: { value: [ i, i ] } });
}
// strings
c = db._create("UnitTestsDumpStrings");

View File

@ -284,7 +284,15 @@ function dumpTestSuite () {
assertEqual(1, c.getIndexes().length); // just primary index
assertEqual("primary", c.getIndexes()[0].type);
assertEqual(0, c.count());
assertEqual(1000, c.count());
for (var i = 0; i < 1000; ++i) {
var doc = c.document(String(7 + (i * 42)));
assertEqual(String(7 + (i * 42)), doc._key);
assertEqual(i, doc.value);
assertEqual({ value: [ i, i ] }, doc.more);
}
},
////////////////////////////////////////////////////////////////////////////////

View File

@ -195,7 +195,7 @@ namespace triagens {
return true;
}
else {
LOG_WARNING("error in SSL handshake: %s", triagens::basics::lastSSLError().c_str());
LOG_TRACE("error in SSL handshake: %s", triagens::basics::lastSSLError().c_str());
return false;
}
}

View File

@ -87,12 +87,13 @@ GeneralClientConnection::~GeneralClientConnection () {
GeneralClientConnection* GeneralClientConnection::factory (Endpoint* endpoint,
double requestTimeout,
double connectTimeout,
size_t numRetries) {
size_t numRetries,
uint32_t sslProtocol) {
if (endpoint->getEncryption() == Endpoint::ENCRYPTION_NONE) {
return new ClientConnection(endpoint, requestTimeout, connectTimeout, numRetries);
}
else if (endpoint->getEncryption() == Endpoint::ENCRYPTION_SSL) {
return new SslClientConnection(endpoint, requestTimeout, connectTimeout, numRetries);
return new SslClientConnection(endpoint, requestTimeout, connectTimeout, numRetries, sslProtocol);
}
else {
return 0;

View File

@ -117,7 +117,11 @@ namespace triagens {
/// @brief create a new connection from an endpoint
////////////////////////////////////////////////////////////////////////////////
static GeneralClientConnection* factory (triagens::rest::Endpoint*, double, double, size_t);
static GeneralClientConnection* factory (triagens::rest::Endpoint*,
double,
double,
size_t,
uint32_t);
////////////////////////////////////////////////////////////////////////////////
/// @brief return the endpoint

View File

@ -29,6 +29,8 @@
#include "Basics/ssl-helper.h"
#include "BasicsC/socket-utils.h"
#include "GeneralServer/GeneralSslServer.h"
#include "HttpServer/HttpsServer.h"
#ifdef TRI_HAVE_LINUX_SOCKETS
#include <netinet/in.h>
@ -45,7 +47,7 @@
#include <sys/types.h>
#include <openssl/ssl.h>
@ -70,15 +72,47 @@ using namespace std;
SslClientConnection::SslClientConnection (Endpoint* endpoint,
double requestTimeout,
double connectTimeout,
size_t connectRetries) :
size_t connectRetries,
uint32_t sslProtocol) :
GeneralClientConnection(endpoint, requestTimeout, connectTimeout, connectRetries),
_ssl(0),
_ctx(0) {
_socket.fileHandle = 0;
_socket.fileDescriptor = 0;
_ctx = SSL_CTX_new(TLSv1_method());
SSL_METHOD SSL_CONST* meth = 0;
switch (HttpsServer::protocol_e(sslProtocol)) {
#ifndef OPENSSL_NO_SSL2
case HttpsServer::SSL_V2:
meth = SSLv2_method();
break;
#endif
case HttpsServer::SSL_V3:
meth = SSLv3_method();
break;
case HttpsServer::SSL_V23:
meth = SSLv23_method();
break;
case HttpsServer::TLS_V1:
meth = TLSv1_method();
break;
default:
// fallback is to use tlsv1
meth = TLSv1_method();
}
_ctx = SSL_CTX_new(meth);
if (_ctx) {
SSL_CTX_set_cipher_list(_ctx, "ALL");
const bool sslCache = true;
SSL_CTX_set_session_cache_mode(_ctx, sslCache ? SSL_SESS_CACHE_SERVER : SSL_SESS_CACHE_OFF);
}
}

View File

@ -71,7 +71,8 @@ namespace triagens {
SslClientConnection (triagens::rest::Endpoint* endpoint,
double,
double,
size_t);
size_t,
uint32_t);
////////////////////////////////////////////////////////////////////////////////
/// @brief destroys a client connection

View File

@ -577,7 +577,7 @@ static v8::Handle<v8::Value> JS_Download (v8::Arguments const& argv) {
TRI_V8_EXCEPTION_MESSAGE(scope, TRI_ERROR_BAD_PARAMETER, "invalid URL");
}
GeneralClientConnection* connection = GeneralClientConnection::factory(ep, timeout, timeout, 3);
GeneralClientConnection* connection = GeneralClientConnection::factory(ep, timeout, timeout, 3, 0);
if (connection == 0) {
delete ep;