Fossil SCM

A general simplification of the server-side TLS logic: Do not store server-certs in settings. Remove the ssl-config subcommands that try to do that. Change command-line options for server-TLS mode on "fossil server" and "fossil http": --cert for the cert file, --pkey for the private key, and omit --tls and --ssl. This check-in supercedes [/timeline?r=tls-server-fix|the tls-server-fix branch]. See [forum:/forumpost/de470658fdf45100|forum post de470658fdf45100].

drh 2022-01-17 16:56 trunk
Commit d7008b34579d2f411784cedca493b05c7be6a9723094acd2c0bb6f11bd8468bb
Parent 6cb0fc259128b93…
3 files changed -19 +26 -151 +16 -15
~ src/db.c ~ src/http_ssl.c ~ src/main.c
M src/db.c
-19
--- src/db.c
+++ src/db.c
@@ -4292,24 +4292,10 @@
42924292
 ** Some platforms may add additional certificates.
42934293
 ** Checking your platform behaviour is required if the
42944294
 ** exact contents of the CA root is critical for your
42954295
 ** application.
42964296
 */
4297
-/*
4298
-** SETTING: ssl-cert width=40 block-text sensitive
4299
-** The text of SSL server certificate and private key used by commands
4300
-** like "fossil server". The text should be in the PEM format. Use
4301
-** the "fossil ssl-config load-certs" command to change this setting.
4302
-*/
4303
-/*
4304
-** SETTING: ssl-cert-file width=40 sensitive
4305
-** The name of a file that contains the SSL server certificate, or
4306
-** optionally the concatenation of the certificate and private key,
4307
-** for use by Fossil when it is acting as a server. If this file
4308
-** contains only the certificate, then the ssl-key-file setting must
4309
-** contain the name of a file containing the private key.
4310
-*/
43114297
 /*
43124298
 ** SETTING: ssl-identity width=40 sensitive
43134299
 ** The full pathname to a file containing a certificate
43144300
 ** and private key in PEM format. Create by concatenating
43154301
 ** the certificate and private key files.
@@ -4316,15 +4302,10 @@
43164302
 **
43174303
 ** This identity will be presented to SSL servers to
43184304
 ** authenticate this client, in addition to the normal
43194305
 ** password authentication.
43204306
 */
4321
-/*
4322
-** SETTING: ssl-key-file width=40 sensitive
4323
-** The name of a file that contains the SSL server certificate private
4324
-** key. Used in combination with "ssl-cert-file".
4325
-*/
43264307
 #ifdef FOSSIL_ENABLE_TCL
43274308
 /*
43284309
 ** SETTING: tcl boolean default=off sensitive
43294310
 ** If enabled Tcl integration commands will be added to the TH1
43304311
 ** interpreter, allowing arbitrary Tcl expressions and
43314312
--- src/db.c
+++ src/db.c
@@ -4292,24 +4292,10 @@
4292 ** Some platforms may add additional certificates.
4293 ** Checking your platform behaviour is required if the
4294 ** exact contents of the CA root is critical for your
4295 ** application.
4296 */
4297 /*
4298 ** SETTING: ssl-cert width=40 block-text sensitive
4299 ** The text of SSL server certificate and private key used by commands
4300 ** like "fossil server". The text should be in the PEM format. Use
4301 ** the "fossil ssl-config load-certs" command to change this setting.
4302 */
4303 /*
4304 ** SETTING: ssl-cert-file width=40 sensitive
4305 ** The name of a file that contains the SSL server certificate, or
4306 ** optionally the concatenation of the certificate and private key,
4307 ** for use by Fossil when it is acting as a server. If this file
4308 ** contains only the certificate, then the ssl-key-file setting must
4309 ** contain the name of a file containing the private key.
4310 */
4311 /*
4312 ** SETTING: ssl-identity width=40 sensitive
4313 ** The full pathname to a file containing a certificate
4314 ** and private key in PEM format. Create by concatenating
4315 ** the certificate and private key files.
@@ -4316,15 +4302,10 @@
4316 **
4317 ** This identity will be presented to SSL servers to
4318 ** authenticate this client, in addition to the normal
4319 ** password authentication.
4320 */
4321 /*
4322 ** SETTING: ssl-key-file width=40 sensitive
4323 ** The name of a file that contains the SSL server certificate private
4324 ** key. Used in combination with "ssl-cert-file".
4325 */
4326 #ifdef FOSSIL_ENABLE_TCL
4327 /*
4328 ** SETTING: tcl boolean default=off sensitive
4329 ** If enabled Tcl integration commands will be added to the TH1
4330 ** interpreter, allowing arbitrary Tcl expressions and
4331
--- src/db.c
+++ src/db.c
@@ -4292,24 +4292,10 @@
4292 ** Some platforms may add additional certificates.
4293 ** Checking your platform behaviour is required if the
4294 ** exact contents of the CA root is critical for your
4295 ** application.
4296 */
 
 
 
 
 
 
 
 
 
 
 
 
 
 
4297 /*
4298 ** SETTING: ssl-identity width=40 sensitive
4299 ** The full pathname to a file containing a certificate
4300 ** and private key in PEM format. Create by concatenating
4301 ** the certificate and private key files.
@@ -4316,15 +4302,10 @@
4302 **
4303 ** This identity will be presented to SSL servers to
4304 ** authenticate this client, in addition to the normal
4305 ** password authentication.
4306 */
 
 
 
 
 
4307 #ifdef FOSSIL_ENABLE_TCL
4308 /*
4309 ** SETTING: tcl boolean default=off sensitive
4310 ** If enabled Tcl integration commands will be added to the TH1
4311 ** interpreter, allowing arbitrary Tcl expressions and
4312
M src/http_ssl.c
+26 -151
--- src/http_ssl.c
+++ src/http_ssl.c
@@ -697,47 +697,48 @@
697697
 ** of disk files that hold the certificate and private-key for the
698698
 ** server. If zCertFile is not NULL but zKeyFile is NULL, then
699699
 ** zCertFile is assumed to be a concatenation of the certificate and
700700
 ** the private-key in the PEM format.
701701
 **
702
-** If zCertFile is NULL, then "ssl-cert" setting is consulted
703
-** to get the certificate and private-key (concatenated together, in
704
-** the PEM format). If there is no ssl-cert setting, then
705
-** a built-in self-signed cert is used.
702
+** If zCertFile is "unsafe-builtin", then a built-in self-signed cert
703
+** is used. This built-in cert is insecure and should only be used for
704
+** testing and debugging.
706705
 */
707706
 void ssl_init_server(const char *zCertFile, const char *zKeyFile){
708
- if( sslIsInit==0 ){
709
- const char *zTlsCert;
707
+ if( sslIsInit==0 && zCertFile ){
710708
 SSL_library_init();
711709
 SSL_load_error_strings();
712710
 OpenSSL_add_all_algorithms();
713711
 sslCtx = SSL_CTX_new(SSLv23_server_method());
714712
 if( sslCtx==0 ){
715713
 ERR_print_errors_fp(stderr);
716714
 fossil_fatal("Error initializing the SSL server");
717715
 }
718
- if( zCertFile && zCertFile[0] ){
716
+ if( fossil_strcmp(zCertFile,"unsafe-builtin")==0 ){
717
+ if( sslctx_use_cert_from_mem(sslCtx, sslSelfCert, -1)
718
+ || sslctx_use_pkey_from_mem(sslCtx, sslSelfPKey, -1)
719
+ ){
720
+ fossil_fatal("Error loading self-signed CERT and KEY");
721
+ }
722
+ }else{
719723
 if( SSL_CTX_use_certificate_chain_file(sslCtx,zCertFile)!=1 ){
720724
 ERR_print_errors_fp(stderr);
721725
 fossil_fatal("Error loading CERT file \"%s\"", zCertFile);
722726
 }
723727
 if( zKeyFile==0 ) zKeyFile = zCertFile;
724728
 if( SSL_CTX_use_PrivateKey_file(sslCtx, zKeyFile, SSL_FILETYPE_PEM)<=0 ){
725729
 ERR_print_errors_fp(stderr);
726
- fossil_fatal("Error loading PRIVATE KEY from file \"%s\"", zKeyFile);
727
- }
728
- }else
729
- if( (zTlsCert = db_get("ssl-cert",0))!=0 ){
730
- if( sslctx_use_cert_from_mem(sslCtx, zTlsCert, -1)
731
- || sslctx_use_pkey_from_mem(sslCtx, zTlsCert, -1)
732
- ){
733
- fossil_fatal("Error loading the CERT from the"
734
- " 'ssl-cert' setting");
735
- }
736
- }else if( sslctx_use_cert_from_mem(sslCtx, sslSelfCert, -1)
737
- || sslctx_use_pkey_from_mem(sslCtx, sslSelfPKey, -1) ){
738
- fossil_fatal("Error loading self-signed CERT");
730
+ if( strcmp(zKeyFile,zCertFile)==0 ){
731
+ fossil_fatal("The private key is not found in \"%s\". "
732
+ "Either append the private key to the certification in that "
733
+ "file or use a separate --pkey option to specify the private key.",
734
+ zKeyFile);
735
+ }else{
736
+ fossil_fatal("Error loading the private key from file \"%s\"",
737
+ zKeyFile);
738
+ }
739
+ }
739740
 }
740741
 if( !SSL_CTX_check_private_key(sslCtx) ){
741742
 fossil_fatal("PRIVATE KEY \"%s\" does not match CERT \"%s\"",
742743
 zKeyFile, zCertFile);
743744
 }
@@ -866,21 +867,10 @@
866867
 ** Security) configuration for Fossil. TLS (formerly SSL) is the
867868
 ** encryption technology used for secure HTTPS transport.
868869
 **
869870
 ** Sub-commands:
870871
 **
871
-** clear-cert Remove information about server certificates.
872
-** This is a subset of the "scrub" command.
873
-**
874
-** load-cert PEM-FILES... Identify server certificate files. These
875
-** should be in the PEM format. There are
876
-** normally two files, the certificate and the
877
-** private-key. By default, the text of both
878
-** files is concatenated and added to the
879
-** "ssl-cert" setting. Use --filename to store
880
-** just the filenames.
881
-**
882872
 ** remove-exception DOMAINS Remove TLS cert exceptions for the domains
883873
 ** listed. Or remove them all if the --all
884874
 ** option is specified.
885875
 **
886876
 ** scrub ?--force? Remove all SSL configuration data from the
@@ -901,102 +891,10 @@
901891
 nCmd = 4;
902892
 }else{
903893
 zCmd = g.argv[2];
904894
 nCmd = strlen(zCmd);
905895
 }
906
- if( strncmp("clear-cert",zCmd,nCmd)==0 && nCmd>=4 ){
907
- int bForce = find_option("force","f",0)!=0;
908
- verify_all_options();
909
- if( !bForce ){
910
- Blob ans;
911
- char cReply;
912
- prompt_user(
913
- "Confirm removing of the SSL server certificate from this repository.\n"
914
- "The removal cannot be undone. Continue (y/N)? ", &ans);
915
- cReply = blob_str(&ans)[0];
916
- if( cReply!='y' && cReply!='Y' ){
917
- fossil_exit(1);
918
- }
919
- }
920
- db_unprotect(PROTECT_ALL);
921
- db_multi_exec(
922
- "PRAGMA secure_delete=ON;"
923
- "DELETE FROM config "
924
- " WHERE name IN ('ssl-cert','ssl-cert-file','ssl-cert-key');"
925
- );
926
- db_protect_pop();
927
- }else
928
- if( strncmp("load-cert",zCmd,nCmd)==0 && nCmd>=4 ){
929
- int bFN = find_option("filename",0,0)!=0;
930
- int i;
931
- Blob allText = BLOB_INITIALIZER;
932
- int haveCert = 0;
933
- int haveKey = 0;
934
- verify_all_options();
935
- db_begin_transaction();
936
- db_unprotect(PROTECT_ALL);
937
- db_multi_exec(
938
- "PRAGMA secure_delete=ON;"
939
- "DELETE FROM config "
940
- " WHERE name IN ('ssl-cert','ssl-cert-file','ssl-cert-key');"
941
- );
942
- nHit = 0;
943
- for(i=3; i<g.argc; i++){
944
- Blob x;
945
- int isCert;
946
- int isKey;
947
- if( !file_isfile(g.argv[i], ExtFILE) ){
948
- fossil_fatal("no such file: \"%s\"", g.argv[i]);
949
- }
950
- blob_read_from_file(&x, g.argv[i], ExtFILE);
951
- isCert = strstr(blob_str(&x),"-----BEGIN CERTIFICATE-----")!=0;
952
- isKey = strstr(blob_str(&x),"-----BEGIN PRIVATE KEY-----")!=0;
953
- if( !isCert && !isKey ){
954
- fossil_fatal("not a certificate or a private key: \"%s\"", g.argv[i]);
955
- }
956
- if( isCert ){
957
- if( haveCert ){
958
- fossil_fatal("more than one certificate provided");
959
- }
960
- haveCert = 1;
961
- if( bFN ){
962
- db_set("ssl-cert-file", file_canonical_name_dup(g.argv[i]), 0);
963
- }else{
964
- blob_append(&allText, blob_buffer(&x), blob_size(&x));
965
- }
966
- if( isKey && !haveKey ){
967
- haveKey = 1;
968
- isKey = 0;
969
- }
970
- }
971
- if( isKey ){
972
- if( haveKey ){
973
- fossil_fatal("more than one private key provided");
974
- }
975
- haveKey = 1;
976
- if( bFN ){
977
- db_set("ssl-key-file", file_canonical_name_dup(g.argv[i]), 0);
978
- }else{
979
- blob_append(&allText, blob_buffer(&x), blob_size(&x));
980
- }
981
- }
982
- }
983
- if( !haveCert ){
984
- if( !haveKey ){
985
- fossil_fatal("missing certificate and private-key");
986
- }else{
987
- fossil_fatal("missing certificate");
988
- }
989
- }else if( !haveKey ){
990
- fossil_fatal("missing private-key");
991
- }
992
- if( !bFN ){
993
- db_set("ssl-cert", blob_str(&allText), 0);
994
- }
995
- db_protect_pop();
996
- db_commit_transaction();
997
- }else
998896
 if( strncmp("scrub",zCmd,nCmd)==0 && nCmd>4 ){
999897
 int bForce = find_option("force","f",0)!=0;
1000898
 verify_all_options();
1001899
 if( !bForce ){
1002900
 Blob ans;
@@ -1084,37 +982,14 @@
1084982
 }
1085983
1086984
 fossil_print("ssl-identity: %s\n", db_get("ssl-identity",""));
1087985
 if( verbose ){
1088986
 fossil_print("\n"
1089
- " This setting is the name of a file that contains the PEM-format\n"
1090
- " certificate and private-key used by Fossil clients to authenticate\n"
1091
- " with servers. Few servers actually require this, so this setting\n"
1092
- " is usually blank.\n\n"
1093
- );
1094
- }
1095
-
1096
- zValue = db_get("ssl-cert",0);
1097
- if( zValue ){
1098
- fossil_print("ssl-cert: (%d-byte PEM)\n", (int)strlen(zValue));
1099
- }else{
1100
- fossil_print("ssl-cert:\n");
1101
- }
1102
- if( verbose ){
1103
- fossil_print("\n"
1104
- " This setting is the PEM-formatted value of the SSL server\n"
1105
- " certificate and private-key, used by Fossil when it is acting\n"
1106
- " as a server via the \"fossil server\" command or similar.\n\n"
1107
- );
1108
- }
1109
-
1110
- fossil_print("ssl-cert-file: %s\n", db_get("ssl-cert-file",""));
1111
- fossil_print("ssl-key-file: %s\n", db_get("ssl-key-file",""));
1112
- if( verbose ){
1113
- fossil_print("\n"
1114
- " This settings are the names of files that contain the certificate\n"
1115
- " private-key used by Fossil when it is acting as a server.\n\n"
987
+ " This setting is the name of a file that contains the PEM-format\n"
988
+ " certificate and private-key used by Fossil clients to authenticate\n"
989
+ " with servers. Few servers actually require this, so this setting\n"
990
+ " is usually blank.\n\n"
1116991
 );
1117992
 }
1118993
1119994
 db_prepare(&q,
1120995
 "SELECT name, '' FROM global_config"
@@ -1179,11 +1054,11 @@
11791054
 db_commit_transaction();
11801055
 blob_reset(&sql);
11811056
 }else
11821057
 /*default*/{
11831058
 fossil_fatal("unknown sub-command \"%s\".\nshould be one of:"
1184
- " clear-cert load-cert remove-exception scrub show",
1059
+ " remove-exception scrub show",
11851060
 zCmd);
11861061
 }
11871062
 }
11881063
11891064
 /*
11901065
--- src/http_ssl.c
+++ src/http_ssl.c
@@ -697,47 +697,48 @@
697 ** of disk files that hold the certificate and private-key for the
698 ** server. If zCertFile is not NULL but zKeyFile is NULL, then
699 ** zCertFile is assumed to be a concatenation of the certificate and
700 ** the private-key in the PEM format.
701 **
702 ** If zCertFile is NULL, then "ssl-cert" setting is consulted
703 ** to get the certificate and private-key (concatenated together, in
704 ** the PEM format). If there is no ssl-cert setting, then
705 ** a built-in self-signed cert is used.
706 */
707 void ssl_init_server(const char *zCertFile, const char *zKeyFile){
708 if( sslIsInit==0 ){
709 const char *zTlsCert;
710 SSL_library_init();
711 SSL_load_error_strings();
712 OpenSSL_add_all_algorithms();
713 sslCtx = SSL_CTX_new(SSLv23_server_method());
714 if( sslCtx==0 ){
715 ERR_print_errors_fp(stderr);
716 fossil_fatal("Error initializing the SSL server");
717 }
718 if( zCertFile && zCertFile[0] ){
 
 
 
 
 
 
719 if( SSL_CTX_use_certificate_chain_file(sslCtx,zCertFile)!=1 ){
720 ERR_print_errors_fp(stderr);
721 fossil_fatal("Error loading CERT file \"%s\"", zCertFile);
722 }
723 if( zKeyFile==0 ) zKeyFile = zCertFile;
724 if( SSL_CTX_use_PrivateKey_file(sslCtx, zKeyFile, SSL_FILETYPE_PEM)<=0 ){
725 ERR_print_errors_fp(stderr);
726 fossil_fatal("Error loading PRIVATE KEY from file \"%s\"", zKeyFile);
727 }
728 }else
729 if( (zTlsCert = db_get("ssl-cert",0))!=0 ){
730 if( sslctx_use_cert_from_mem(sslCtx, zTlsCert, -1)
731 || sslctx_use_pkey_from_mem(sslCtx, zTlsCert, -1)
732 ){
733 fossil_fatal("Error loading the CERT from the"
734 " 'ssl-cert' setting");
735 }
736 }else if( sslctx_use_cert_from_mem(sslCtx, sslSelfCert, -1)
737 || sslctx_use_pkey_from_mem(sslCtx, sslSelfPKey, -1) ){
738 fossil_fatal("Error loading self-signed CERT");
739 }
740 if( !SSL_CTX_check_private_key(sslCtx) ){
741 fossil_fatal("PRIVATE KEY \"%s\" does not match CERT \"%s\"",
742 zKeyFile, zCertFile);
743 }
@@ -866,21 +867,10 @@
866 ** Security) configuration for Fossil. TLS (formerly SSL) is the
867 ** encryption technology used for secure HTTPS transport.
868 **
869 ** Sub-commands:
870 **
871 ** clear-cert Remove information about server certificates.
872 ** This is a subset of the "scrub" command.
873 **
874 ** load-cert PEM-FILES... Identify server certificate files. These
875 ** should be in the PEM format. There are
876 ** normally two files, the certificate and the
877 ** private-key. By default, the text of both
878 ** files is concatenated and added to the
879 ** "ssl-cert" setting. Use --filename to store
880 ** just the filenames.
881 **
882 ** remove-exception DOMAINS Remove TLS cert exceptions for the domains
883 ** listed. Or remove them all if the --all
884 ** option is specified.
885 **
886 ** scrub ?--force? Remove all SSL configuration data from the
@@ -901,102 +891,10 @@
901 nCmd = 4;
902 }else{
903 zCmd = g.argv[2];
904 nCmd = strlen(zCmd);
905 }
906 if( strncmp("clear-cert",zCmd,nCmd)==0 && nCmd>=4 ){
907 int bForce = find_option("force","f",0)!=0;
908 verify_all_options();
909 if( !bForce ){
910 Blob ans;
911 char cReply;
912 prompt_user(
913 "Confirm removing of the SSL server certificate from this repository.\n"
914 "The removal cannot be undone. Continue (y/N)? ", &ans);
915 cReply = blob_str(&ans)[0];
916 if( cReply!='y' && cReply!='Y' ){
917 fossil_exit(1);
918 }
919 }
920 db_unprotect(PROTECT_ALL);
921 db_multi_exec(
922 "PRAGMA secure_delete=ON;"
923 "DELETE FROM config "
924 " WHERE name IN ('ssl-cert','ssl-cert-file','ssl-cert-key');"
925 );
926 db_protect_pop();
927 }else
928 if( strncmp("load-cert",zCmd,nCmd)==0 && nCmd>=4 ){
929 int bFN = find_option("filename",0,0)!=0;
930 int i;
931 Blob allText = BLOB_INITIALIZER;
932 int haveCert = 0;
933 int haveKey = 0;
934 verify_all_options();
935 db_begin_transaction();
936 db_unprotect(PROTECT_ALL);
937 db_multi_exec(
938 "PRAGMA secure_delete=ON;"
939 "DELETE FROM config "
940 " WHERE name IN ('ssl-cert','ssl-cert-file','ssl-cert-key');"
941 );
942 nHit = 0;
943 for(i=3; i<g.argc; i++){
944 Blob x;
945 int isCert;
946 int isKey;
947 if( !file_isfile(g.argv[i], ExtFILE) ){
948 fossil_fatal("no such file: \"%s\"", g.argv[i]);
949 }
950 blob_read_from_file(&x, g.argv[i], ExtFILE);
951 isCert = strstr(blob_str(&x),"-----BEGIN CERTIFICATE-----")!=0;
952 isKey = strstr(blob_str(&x),"-----BEGIN PRIVATE KEY-----")!=0;
953 if( !isCert && !isKey ){
954 fossil_fatal("not a certificate or a private key: \"%s\"", g.argv[i]);
955 }
956 if( isCert ){
957 if( haveCert ){
958 fossil_fatal("more than one certificate provided");
959 }
960 haveCert = 1;
961 if( bFN ){
962 db_set("ssl-cert-file", file_canonical_name_dup(g.argv[i]), 0);
963 }else{
964 blob_append(&allText, blob_buffer(&x), blob_size(&x));
965 }
966 if( isKey && !haveKey ){
967 haveKey = 1;
968 isKey = 0;
969 }
970 }
971 if( isKey ){
972 if( haveKey ){
973 fossil_fatal("more than one private key provided");
974 }
975 haveKey = 1;
976 if( bFN ){
977 db_set("ssl-key-file", file_canonical_name_dup(g.argv[i]), 0);
978 }else{
979 blob_append(&allText, blob_buffer(&x), blob_size(&x));
980 }
981 }
982 }
983 if( !haveCert ){
984 if( !haveKey ){
985 fossil_fatal("missing certificate and private-key");
986 }else{
987 fossil_fatal("missing certificate");
988 }
989 }else if( !haveKey ){
990 fossil_fatal("missing private-key");
991 }
992 if( !bFN ){
993 db_set("ssl-cert", blob_str(&allText), 0);
994 }
995 db_protect_pop();
996 db_commit_transaction();
997 }else
998 if( strncmp("scrub",zCmd,nCmd)==0 && nCmd>4 ){
999 int bForce = find_option("force","f",0)!=0;
1000 verify_all_options();
1001 if( !bForce ){
1002 Blob ans;
@@ -1084,37 +982,14 @@
1084 }
1085
1086 fossil_print("ssl-identity: %s\n", db_get("ssl-identity",""));
1087 if( verbose ){
1088 fossil_print("\n"
1089 " This setting is the name of a file that contains the PEM-format\n"
1090 " certificate and private-key used by Fossil clients to authenticate\n"
1091 " with servers. Few servers actually require this, so this setting\n"
1092 " is usually blank.\n\n"
1093 );
1094 }
1095
1096 zValue = db_get("ssl-cert",0);
1097 if( zValue ){
1098 fossil_print("ssl-cert: (%d-byte PEM)\n", (int)strlen(zValue));
1099 }else{
1100 fossil_print("ssl-cert:\n");
1101 }
1102 if( verbose ){
1103 fossil_print("\n"
1104 " This setting is the PEM-formatted value of the SSL server\n"
1105 " certificate and private-key, used by Fossil when it is acting\n"
1106 " as a server via the \"fossil server\" command or similar.\n\n"
1107 );
1108 }
1109
1110 fossil_print("ssl-cert-file: %s\n", db_get("ssl-cert-file",""));
1111 fossil_print("ssl-key-file: %s\n", db_get("ssl-key-file",""));
1112 if( verbose ){
1113 fossil_print("\n"
1114 " This settings are the names of files that contain the certificate\n"
1115 " private-key used by Fossil when it is acting as a server.\n\n"
1116 );
1117 }
1118
1119 db_prepare(&q,
1120 "SELECT name, '' FROM global_config"
@@ -1179,11 +1054,11 @@
1179 db_commit_transaction();
1180 blob_reset(&sql);
1181 }else
1182 /*default*/{
1183 fossil_fatal("unknown sub-command \"%s\".\nshould be one of:"
1184 " clear-cert load-cert remove-exception scrub show",
1185 zCmd);
1186 }
1187 }
1188
1189 /*
1190
--- src/http_ssl.c
+++ src/http_ssl.c
@@ -697,47 +697,48 @@
697 ** of disk files that hold the certificate and private-key for the
698 ** server. If zCertFile is not NULL but zKeyFile is NULL, then
699 ** zCertFile is assumed to be a concatenation of the certificate and
700 ** the private-key in the PEM format.
701 **
702 ** If zCertFile is "unsafe-builtin", then a built-in self-signed cert
703 ** is used. This built-in cert is insecure and should only be used for
704 ** testing and debugging.
 
705 */
706 void ssl_init_server(const char *zCertFile, const char *zKeyFile){
707 if( sslIsInit==0 && zCertFile ){
 
708 SSL_library_init();
709 SSL_load_error_strings();
710 OpenSSL_add_all_algorithms();
711 sslCtx = SSL_CTX_new(SSLv23_server_method());
712 if( sslCtx==0 ){
713 ERR_print_errors_fp(stderr);
714 fossil_fatal("Error initializing the SSL server");
715 }
716 if( fossil_strcmp(zCertFile,"unsafe-builtin")==0 ){
717 if( sslctx_use_cert_from_mem(sslCtx, sslSelfCert, -1)
718 || sslctx_use_pkey_from_mem(sslCtx, sslSelfPKey, -1)
719 ){
720 fossil_fatal("Error loading self-signed CERT and KEY");
721 }
722 }else{
723 if( SSL_CTX_use_certificate_chain_file(sslCtx,zCertFile)!=1 ){
724 ERR_print_errors_fp(stderr);
725 fossil_fatal("Error loading CERT file \"%s\"", zCertFile);
726 }
727 if( zKeyFile==0 ) zKeyFile = zCertFile;
728 if( SSL_CTX_use_PrivateKey_file(sslCtx, zKeyFile, SSL_FILETYPE_PEM)<=0 ){
729 ERR_print_errors_fp(stderr);
730 if( strcmp(zKeyFile,zCertFile)==0 ){
731 fossil_fatal("The private key is not found in \"%s\". "
732 "Either append the private key to the certification in that "
733 "file or use a separate --pkey option to specify the private key.",
734 zKeyFile);
735 }else{
736 fossil_fatal("Error loading the private key from file \"%s\"",
737 zKeyFile);
738 }
739 }
 
 
 
740 }
741 if( !SSL_CTX_check_private_key(sslCtx) ){
742 fossil_fatal("PRIVATE KEY \"%s\" does not match CERT \"%s\"",
743 zKeyFile, zCertFile);
744 }
@@ -866,21 +867,10 @@
867 ** Security) configuration for Fossil. TLS (formerly SSL) is the
868 ** encryption technology used for secure HTTPS transport.
869 **
870 ** Sub-commands:
871 **
 
 
 
 
 
 
 
 
 
 
 
872 ** remove-exception DOMAINS Remove TLS cert exceptions for the domains
873 ** listed. Or remove them all if the --all
874 ** option is specified.
875 **
876 ** scrub ?--force? Remove all SSL configuration data from the
@@ -901,102 +891,10 @@
891 nCmd = 4;
892 }else{
893 zCmd = g.argv[2];
894 nCmd = strlen(zCmd);
895 }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
896 if( strncmp("scrub",zCmd,nCmd)==0 && nCmd>4 ){
897 int bForce = find_option("force","f",0)!=0;
898 verify_all_options();
899 if( !bForce ){
900 Blob ans;
@@ -1084,37 +982,14 @@
982 }
983
984 fossil_print("ssl-identity: %s\n", db_get("ssl-identity",""));
985 if( verbose ){
986 fossil_print("\n"
987 " This setting is the name of a file that contains the PEM-format\n"
988 " certificate and private-key used by Fossil clients to authenticate\n"
989 " with servers. Few servers actually require this, so this setting\n"
990 " is usually blank.\n\n"
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
991 );
992 }
993
994 db_prepare(&q,
995 "SELECT name, '' FROM global_config"
@@ -1179,11 +1054,11 @@
1054 db_commit_transaction();
1055 blob_reset(&sql);
1056 }else
1057 /*default*/{
1058 fossil_fatal("unknown sub-command \"%s\".\nshould be one of:"
1059 " remove-exception scrub show",
1060 zCmd);
1061 }
1062 }
1063
1064 /*
1065
M src/main.c
+16 -15
--- src/main.c
+++ src/main.c
@@ -2597,18 +2597,18 @@
25972597
 ** SSL should be used, and initialize the SSL decoder.
25982598
 */
25992599
 static void decode_ssl_options(void){
26002600
 #if FOSSIL_ENABLE_SSL
26012601
 const char *zCertFile = 0;
2602
- zCertFile = find_option("tls-cert-file",0,1);
2602
+ const char *zKeyFile = 0;
2603
+ zCertFile = find_option("cert",0,1);
2604
+ zKeyFile = find_option("pkey",0,1);
26032605
 if( zCertFile ){
26042606
 g.httpUseSSL = 1;
2605
- ssl_init_server(zCertFile, zCertFile);
2606
- }
2607
- if( find_option("tls",0,0)!=0 || find_option("ssl",0,0)!=0 ){
2608
- g.httpUseSSL = 1;
2609
- ssl_init_server(0,0);
2607
+ ssl_init_server(zCertFile, zKeyFile);
2608
+ }else if( zKeyFile ){
2609
+ fossil_fatal("--pkey without a corresponding --cert");
26102610
 }
26112611
 #endif
26122612
 }
26132613
26142614
 /*
@@ -2644,10 +2644,12 @@
26442644
 ** enabled.
26452645
 **
26462646
 ** Options:
26472647
 ** --acme Deliver files from the ".well-known" subdirectory
26482648
 ** --baseurl URL base URL (useful with reverse proxies)
2649
+** --cert FILE Use TLS (HTTPS) encryption with the certificate (the
2650
+** fullchain.pem) taken from FILE.
26492651
 ** --chroot DIR Use directory for chroot instead of repository path.
26502652
 ** --ckout-alias N Treat URIs of the form /doc/N/... as if they were
26512653
 ** /doc/ckout/...
26522654
 ** --extroot DIR document root for the /ext extension mechanism
26532655
 ** --files GLOB comma-separate glob patterns for static file to serve
@@ -2676,17 +2678,15 @@
26762678
 ** process exit
26772679
 ** --nojail drop root privilege but do not enter the chroot jail
26782680
 ** --nossl signal that no SSL connections are available
26792681
 ** --notfound URL use URL as "HTTP 404, object not found" page.
26802682
 ** --out FILE write results to FILE instead of to standard output
2683
+** --pkey FILE Read the private key used for TLS from FILE.
26812684
 ** --repolist If REPOSITORY is directory, URL "/" lists all repos
26822685
 ** --scgi Interpret input as SCGI rather than HTTP
26832686
 ** --skin LABEL Use override skin LABEL
2684
-** --ssl Use TLS (HTTPS) encryption. Alias for --tls
26852687
 ** --th-trace trace TH1 execution (for debugging purposes)
2686
-** --tls Use TLS (HTTPS) encryption.
2687
-** --tls-cert-file FN Read the TLS certificate and private key from FN
26882688
 ** --usepidkey Use saved encryption key from parent process. This is
26892689
 ** only necessary when using SEE on Windows.
26902690
 **
26912691
 ** See also: [[cgi]], [[server]], [[winsrv]]
26922692
 */
@@ -2976,10 +2976,12 @@
29762976
 ** by default.
29772977
 **
29782978
 ** Options:
29792979
 ** --acme Deliver files from the ".well-known" subdirectory.
29802980
 ** --baseurl URL Use URL as the base (useful for reverse proxies)
2981
+** --cert FILE Use TLS (HTTPS) encryption with the certificate (the
2982
+** fullchain.pem) taken from FILE.
29812983
 ** --chroot DIR Use directory for chroot instead of repository path.
29822984
 ** --ckout-alias NAME Treat URIs of the form /doc/NAME/... as if they were
29832985
 ** /doc/ckout/...
29842986
 ** --create Create a new REPOSITORY if it does not already exist
29852987
 ** --extroot DIR Document root for the /ext extension mechanism
@@ -3008,22 +3010,21 @@
30083010
 ** seconds (only works on unix)
30093011
 ** --nobrowser Do not automatically launch a web-browser for the
30103012
 ** "fossil ui" command.
30113013
 ** --nocompress Do not compress HTTP replies
30123014
 ** --nojail Drop root privileges but do not enter the chroot jail
3013
-** --nossl signal that no SSL connections are available (Always
3014
-** set by default for the "ui" command)
3015
-** --notfound URL Redirect
3015
+** --nossl do not force redirects to SSL even if the repository
3016
+** setting "redirect-to-https" requests it. This is set
3017
+** by default for the "ui" command.
3018
+** --notfound URL Redirect to URL if a page is not found.
30163019
 ** --page PAGE Start "ui" on PAGE. ex: --page "timeline?y=ci"
3020
+** --pkey FILE Read the private key used for TLS from FILE.
30173021
 ** -P|--port TCPPORT listen to request on port TCPPORT
30183022
 ** --repolist If REPOSITORY is dir, URL "/" lists repos.
30193023
 ** --scgi Accept SCGI rather than HTTP
30203024
 ** --skin LABEL Use override skin LABEL
3021
-** --ssl Use TLS (HTTPS) encryption. Alias for --tls
30223025
 ** --th-trace trace TH1 execution (for debugging purposes)
3023
-** --tls Use TLS (HTTPS) encryption.
3024
-** --tls-cert-file FN Read the TLS certificate and private key from FN
30253026
 ** --usepidkey Use saved encryption key from parent process. This is
30263027
 ** only necessary when using SEE on Windows.
30273028
 **
30283029
 ** See also: [[cgi]], [[http]], [[winsrv]]
30293030
 */
30303031
--- src/main.c
+++ src/main.c
@@ -2597,18 +2597,18 @@
2597 ** SSL should be used, and initialize the SSL decoder.
2598 */
2599 static void decode_ssl_options(void){
2600 #if FOSSIL_ENABLE_SSL
2601 const char *zCertFile = 0;
2602 zCertFile = find_option("tls-cert-file",0,1);
 
 
2603 if( zCertFile ){
2604 g.httpUseSSL = 1;
2605 ssl_init_server(zCertFile, zCertFile);
2606 }
2607 if( find_option("tls",0,0)!=0 || find_option("ssl",0,0)!=0 ){
2608 g.httpUseSSL = 1;
2609 ssl_init_server(0,0);
2610 }
2611 #endif
2612 }
2613
2614 /*
@@ -2644,10 +2644,12 @@
2644 ** enabled.
2645 **
2646 ** Options:
2647 ** --acme Deliver files from the ".well-known" subdirectory
2648 ** --baseurl URL base URL (useful with reverse proxies)
 
 
2649 ** --chroot DIR Use directory for chroot instead of repository path.
2650 ** --ckout-alias N Treat URIs of the form /doc/N/... as if they were
2651 ** /doc/ckout/...
2652 ** --extroot DIR document root for the /ext extension mechanism
2653 ** --files GLOB comma-separate glob patterns for static file to serve
@@ -2676,17 +2678,15 @@
2676 ** process exit
2677 ** --nojail drop root privilege but do not enter the chroot jail
2678 ** --nossl signal that no SSL connections are available
2679 ** --notfound URL use URL as "HTTP 404, object not found" page.
2680 ** --out FILE write results to FILE instead of to standard output
 
2681 ** --repolist If REPOSITORY is directory, URL "/" lists all repos
2682 ** --scgi Interpret input as SCGI rather than HTTP
2683 ** --skin LABEL Use override skin LABEL
2684 ** --ssl Use TLS (HTTPS) encryption. Alias for --tls
2685 ** --th-trace trace TH1 execution (for debugging purposes)
2686 ** --tls Use TLS (HTTPS) encryption.
2687 ** --tls-cert-file FN Read the TLS certificate and private key from FN
2688 ** --usepidkey Use saved encryption key from parent process. This is
2689 ** only necessary when using SEE on Windows.
2690 **
2691 ** See also: [[cgi]], [[server]], [[winsrv]]
2692 */
@@ -2976,10 +2976,12 @@
2976 ** by default.
2977 **
2978 ** Options:
2979 ** --acme Deliver files from the ".well-known" subdirectory.
2980 ** --baseurl URL Use URL as the base (useful for reverse proxies)
 
 
2981 ** --chroot DIR Use directory for chroot instead of repository path.
2982 ** --ckout-alias NAME Treat URIs of the form /doc/NAME/... as if they were
2983 ** /doc/ckout/...
2984 ** --create Create a new REPOSITORY if it does not already exist
2985 ** --extroot DIR Document root for the /ext extension mechanism
@@ -3008,22 +3010,21 @@
3008 ** seconds (only works on unix)
3009 ** --nobrowser Do not automatically launch a web-browser for the
3010 ** "fossil ui" command.
3011 ** --nocompress Do not compress HTTP replies
3012 ** --nojail Drop root privileges but do not enter the chroot jail
3013 ** --nossl signal that no SSL connections are available (Always
3014 ** set by default for the "ui" command)
3015 ** --notfound URL Redirect
 
3016 ** --page PAGE Start "ui" on PAGE. ex: --page "timeline?y=ci"
 
3017 ** -P|--port TCPPORT listen to request on port TCPPORT
3018 ** --repolist If REPOSITORY is dir, URL "/" lists repos.
3019 ** --scgi Accept SCGI rather than HTTP
3020 ** --skin LABEL Use override skin LABEL
3021 ** --ssl Use TLS (HTTPS) encryption. Alias for --tls
3022 ** --th-trace trace TH1 execution (for debugging purposes)
3023 ** --tls Use TLS (HTTPS) encryption.
3024 ** --tls-cert-file FN Read the TLS certificate and private key from FN
3025 ** --usepidkey Use saved encryption key from parent process. This is
3026 ** only necessary when using SEE on Windows.
3027 **
3028 ** See also: [[cgi]], [[http]], [[winsrv]]
3029 */
3030
--- src/main.c
+++ src/main.c
@@ -2597,18 +2597,18 @@
2597 ** SSL should be used, and initialize the SSL decoder.
2598 */
2599 static void decode_ssl_options(void){
2600 #if FOSSIL_ENABLE_SSL
2601 const char *zCertFile = 0;
2602 const char *zKeyFile = 0;
2603 zCertFile = find_option("cert",0,1);
2604 zKeyFile = find_option("pkey",0,1);
2605 if( zCertFile ){
2606 g.httpUseSSL = 1;
2607 ssl_init_server(zCertFile, zKeyFile);
2608 }else if( zKeyFile ){
2609 fossil_fatal("--pkey without a corresponding --cert");
 
 
2610 }
2611 #endif
2612 }
2613
2614 /*
@@ -2644,10 +2644,12 @@
2644 ** enabled.
2645 **
2646 ** Options:
2647 ** --acme Deliver files from the ".well-known" subdirectory
2648 ** --baseurl URL base URL (useful with reverse proxies)
2649 ** --cert FILE Use TLS (HTTPS) encryption with the certificate (the
2650 ** fullchain.pem) taken from FILE.
2651 ** --chroot DIR Use directory for chroot instead of repository path.
2652 ** --ckout-alias N Treat URIs of the form /doc/N/... as if they were
2653 ** /doc/ckout/...
2654 ** --extroot DIR document root for the /ext extension mechanism
2655 ** --files GLOB comma-separate glob patterns for static file to serve
@@ -2676,17 +2678,15 @@
2678 ** process exit
2679 ** --nojail drop root privilege but do not enter the chroot jail
2680 ** --nossl signal that no SSL connections are available
2681 ** --notfound URL use URL as "HTTP 404, object not found" page.
2682 ** --out FILE write results to FILE instead of to standard output
2683 ** --pkey FILE Read the private key used for TLS from FILE.
2684 ** --repolist If REPOSITORY is directory, URL "/" lists all repos
2685 ** --scgi Interpret input as SCGI rather than HTTP
2686 ** --skin LABEL Use override skin LABEL
 
2687 ** --th-trace trace TH1 execution (for debugging purposes)
 
 
2688 ** --usepidkey Use saved encryption key from parent process. This is
2689 ** only necessary when using SEE on Windows.
2690 **
2691 ** See also: [[cgi]], [[server]], [[winsrv]]
2692 */
@@ -2976,10 +2976,12 @@
2976 ** by default.
2977 **
2978 ** Options:
2979 ** --acme Deliver files from the ".well-known" subdirectory.
2980 ** --baseurl URL Use URL as the base (useful for reverse proxies)
2981 ** --cert FILE Use TLS (HTTPS) encryption with the certificate (the
2982 ** fullchain.pem) taken from FILE.
2983 ** --chroot DIR Use directory for chroot instead of repository path.
2984 ** --ckout-alias NAME Treat URIs of the form /doc/NAME/... as if they were
2985 ** /doc/ckout/...
2986 ** --create Create a new REPOSITORY if it does not already exist
2987 ** --extroot DIR Document root for the /ext extension mechanism
@@ -3008,22 +3010,21 @@
3010 ** seconds (only works on unix)
3011 ** --nobrowser Do not automatically launch a web-browser for the
3012 ** "fossil ui" command.
3013 ** --nocompress Do not compress HTTP replies
3014 ** --nojail Drop root privileges but do not enter the chroot jail
3015 ** --nossl do not force redirects to SSL even if the repository
3016 ** setting "redirect-to-https" requests it. This is set
3017 ** by default for the "ui" command.
3018 ** --notfound URL Redirect to URL if a page is not found.
3019 ** --page PAGE Start "ui" on PAGE. ex: --page "timeline?y=ci"
3020 ** --pkey FILE Read the private key used for TLS from FILE.
3021 ** -P|--port TCPPORT listen to request on port TCPPORT
3022 ** --repolist If REPOSITORY is dir, URL "/" lists repos.
3023 ** --scgi Accept SCGI rather than HTTP
3024 ** --skin LABEL Use override skin LABEL
 
3025 ** --th-trace trace TH1 execution (for debugging purposes)
 
 
3026 ** --usepidkey Use saved encryption key from parent process. This is
3027 ** only necessary when using SEE on Windows.
3028 **
3029 ** See also: [[cgi]], [[http]], [[winsrv]]
3030 */
3031

Keyboard Shortcuts

Open search /
Next entry (timeline) j
Previous entry (timeline) k
Open focused entry Enter
Show this help ?
Toggle theme Top nav button