You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@couchdb.apache.org by rn...@apache.org on 2014/05/22 13:14:35 UTC
[1/4] chttpd commit: updated refs/heads/master to 7c7c19f
Repository: couchdb-chttpd
Updated Branches:
refs/heads/master 76d82fc3c -> 7c7c19ff6
Allow optional max_uri_length server setting
Project: http://git-wip-us.apache.org/repos/asf/couchdb-chttpd/repo
Commit: http://git-wip-us.apache.org/repos/asf/couchdb-chttpd/commit/eaf1b56a
Tree: http://git-wip-us.apache.org/repos/asf/couchdb-chttpd/tree/eaf1b56a
Diff: http://git-wip-us.apache.org/repos/asf/couchdb-chttpd/diff/eaf1b56a
Branch: refs/heads/master
Commit: eaf1b56ae63fa6f5708348246933de2aa1602130
Parents: 76d82fc
Author: Robert Newson <rn...@apache.org>
Authored: Thu May 22 11:52:02 2014 +0100
Committer: Robert Newson <rn...@apache.org>
Committed: Thu May 22 11:52:02 2014 +0100
----------------------------------------------------------------------
src/chttpd.erl | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/couchdb-chttpd/blob/eaf1b56a/src/chttpd.erl
----------------------------------------------------------------------
diff --git a/src/chttpd.erl b/src/chttpd.erl
index dd184c0..f9ed560 100644
--- a/src/chttpd.erl
+++ b/src/chttpd.erl
@@ -203,6 +203,7 @@ handle_request(MochiReq) ->
Result =
try
+ check_request_uri_length(RawUri),
case authenticate_request(HttpReq, AuthenticationFuns) of
#httpd{} = Req ->
HandlerFun = url_handler(HandlerKey),
@@ -220,6 +221,8 @@ handle_request(MochiReq) ->
exit:{mochiweb_recv_error, E} ->
couch_log:notice(LogForClosedSocket ++ " - ~p", [E]),
exit(normal);
+ exit:{uri_too_long, _} ->
+ send_error(HttpReq, request_uri_too_long);
throw:Error ->
send_error(HttpReq, Error);
error:database_does_not_exist ->
@@ -276,6 +279,19 @@ possibly_hack(#httpd{path_parts=[<<"_replicate">>]}=Req) ->
possibly_hack(Req) ->
Req.
+check_request_uri_length(Uri) ->
+ check_request_uri_length(Uri, config:get("httpd", "max_uri_length")).
+
+check_request_uri_length(_Uri, undefined) ->
+ ok;
+check_request_uri_length(Uri, MaxUriLen) when is_list(MaxUriLen) ->
+ case length(Uri) > list_to_integer(MaxUriLen) of
+ true ->
+ throw(request_uri_too_long);
+ false ->
+ ok
+ end.
+
fix_uri(Req, Props, Type) ->
case is_http(replication_uri(Type, Props)) of
true ->
@@ -694,6 +710,8 @@ error_info({r_quorum_not_met, Reason}) ->
{412, <<"read_quorum_not_met">>, Reason};
error_info({w_quorum_not_met, Reason}) ->
{500, <<"write_quorum_not_met">>, Reason};
+error_info(request_uri_too_long) ->
+ {414, <<"too_long">>, <<"the request uri is too long">>};
error_info({bad_ctype, Reason}) ->
{415, <<"bad_content_type">>, Reason};
error_info(requested_range_not_satisfiable) ->
[4/4] chttpd commit: updated refs/heads/master to 7c7c19f
Posted by rn...@apache.org.
Support `fail_if_no_peer_cert` ssl option
Project: http://git-wip-us.apache.org/repos/asf/couchdb-chttpd/repo
Commit: http://git-wip-us.apache.org/repos/asf/couchdb-chttpd/commit/7c7c19ff
Tree: http://git-wip-us.apache.org/repos/asf/couchdb-chttpd/tree/7c7c19ff
Diff: http://git-wip-us.apache.org/repos/asf/couchdb-chttpd/diff/7c7c19ff
Branch: refs/heads/master
Commit: 7c7c19ff628929417c37cb26b91a40c388c57dec
Parents: c27884b
Author: Robert Newson <rn...@apache.org>
Authored: Thu May 22 12:11:29 2014 +0100
Committer: Robert Newson <rn...@apache.org>
Committed: Thu May 22 12:13:14 2014 +0100
----------------------------------------------------------------------
src/chttpd.erl | 5 +++++
1 file changed, 5 insertions(+)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/couchdb-chttpd/blob/7c7c19ff/src/chttpd.erl
----------------------------------------------------------------------
diff --git a/src/chttpd.erl b/src/chttpd.erl
index fb9a94d..8618811 100644
--- a/src/chttpd.erl
+++ b/src/chttpd.erl
@@ -77,8 +77,13 @@ start_link(https) ->
"false" ->
[];
"true" ->
+ FailIfNoPeerCert = case config:get("ssl", "fail_if_no_peer_cert", "false") of
+ "false" -> false;
+ "true" -> true
+ end,
[{depth, list_to_integer(config:get("ssl",
"ssl_certificate_max_depth", "1"))},
+ {fail_if_no_peer_cert, FailIfNoPeerCert},
{verify, verify_peer}] ++
case config:get("ssl", "verify_fun", nil) of
nil -> [];
[3/4] chttpd commit: updated refs/heads/master to 7c7c19f
Posted by rn...@apache.org.
Support for user configurable SSL ciphers
Project: http://git-wip-us.apache.org/repos/asf/couchdb-chttpd/repo
Commit: http://git-wip-us.apache.org/repos/asf/couchdb-chttpd/commit/c27884bf
Tree: http://git-wip-us.apache.org/repos/asf/couchdb-chttpd/tree/c27884bf
Diff: http://git-wip-us.apache.org/repos/asf/couchdb-chttpd/diff/c27884bf
Branch: refs/heads/master
Commit: c27884bf37404d45d921740d8914e576fa6c78b0
Parents: 009fa9a
Author: Robert Newson <rn...@apache.org>
Authored: Thu May 22 12:10:51 2014 +0100
Committer: Robert Newson <rn...@apache.org>
Committed: Thu May 22 12:13:14 2014 +0100
----------------------------------------------------------------------
src/chttpd.erl | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/couchdb-chttpd/blob/c27884bf/src/chttpd.erl
----------------------------------------------------------------------
diff --git a/src/chttpd.erl b/src/chttpd.erl
index 8a70707..fb9a94d 100644
--- a/src/chttpd.erl
+++ b/src/chttpd.erl
@@ -50,11 +50,17 @@ start_link(http) ->
start_link(https) ->
Port = config:get("ssl", "port", "6984"),
+ {ok, Ciphers} = couch_util:parse_term(config:get("ssl", "ciphers", "nil")),
+ {ok, Versions} = couch_util:parse_term(config:get("ssl", "tls_versions", "nil")),
+ {ok, SecureRenegotiate} = couch_util:parse_term(config:get("ssl", "secure_renegotiate", "nil")),
ServerOpts0 =
[{cacertfile, config:get("ssl", "cacert_file", nil)},
{keyfile, config:get("ssl", "key_file", nil)},
{certfile, config:get("ssl", "cert_file", nil)},
- {password, config:get("ssl", "password", nil)}],
+ {password, config:get("ssl", "password", nil)},
+ {secure_renegotiate, SecureRenegotiate},
+ {versions, Versions},
+ {ciphers, Ciphers}],
case (couch_util:get_value(keyfile, ServerOpts0) == nil orelse
couch_util:get_value(certfile, ServerOpts0) == nil) of
[2/4] chttpd commit: updated refs/heads/master to 7c7c19f
Posted by rn...@apache.org.
Allow cacertfile without verifying peers
COUCHDB-2028
Project: http://git-wip-us.apache.org/repos/asf/couchdb-chttpd/repo
Commit: http://git-wip-us.apache.org/repos/asf/couchdb-chttpd/commit/009fa9af
Tree: http://git-wip-us.apache.org/repos/asf/couchdb-chttpd/tree/009fa9af
Diff: http://git-wip-us.apache.org/repos/asf/couchdb-chttpd/diff/009fa9af
Branch: refs/heads/master
Commit: 009fa9afbc2b67d339e8ef5e0eb18974196583e2
Parents: eaf1b56
Author: Robert Newson <rn...@apache.org>
Authored: Thu May 22 12:09:41 2014 +0100
Committer: Robert Newson <rn...@apache.org>
Committed: Thu May 22 12:13:09 2014 +0100
----------------------------------------------------------------------
src/chttpd.erl | 83 ++++++++++++++++++++++-------------------------------
1 file changed, 34 insertions(+), 49 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/couchdb-chttpd/blob/009fa9af/src/chttpd.erl
----------------------------------------------------------------------
diff --git a/src/chttpd.erl b/src/chttpd.erl
index f9ed560..8a70707 100644
--- a/src/chttpd.erl
+++ b/src/chttpd.erl
@@ -49,58 +49,43 @@ start_link(http) ->
start_link(?MODULE, [{port, Port}]);
start_link(https) ->
- Port = config:get("chttps", "port", "6984"),
- CertFile = config:get("chttps", "cert_file", nil),
- KeyFile = config:get("chttps", "key_file", nil),
- Options = case CertFile /= nil andalso KeyFile /= nil of
+ Port = config:get("ssl", "port", "6984"),
+ ServerOpts0 =
+ [{cacertfile, config:get("ssl", "cacert_file", nil)},
+ {keyfile, config:get("ssl", "key_file", nil)},
+ {certfile, config:get("ssl", "cert_file", nil)},
+ {password, config:get("ssl", "password", nil)}],
+
+ case (couch_util:get_value(keyfile, ServerOpts0) == nil orelse
+ couch_util:get_value(certfile, ServerOpts0) == nil) of
true ->
- SslOpts = [{certfile, CertFile}, {keyfile, KeyFile}],
-
- %% set password if one is needed for the cert
- SslOpts1 = case config:get("chttps", "password", nil) of
- nil -> SslOpts;
- Password ->
- SslOpts ++ [{password, Password}]
- end,
- % do we verify certificates ?
- FinalSslOpts = case config:get("chttps",
- "verify_ssl_certificates", "false") of
- "false" -> SslOpts1;
- "true" ->
- case config:get("chttps",
- "cacert_file", nil) of
- nil ->
- io:format("Verify SSL certificate "
- ++"enabled but file containing "
- ++"PEM encoded CA certificates is "
- ++"missing", []),
- throw({error, missing_cacerts});
- CaCertFile ->
- Depth = list_to_integer(config:get("chttps",
- "ssl_certificate_max_depth",
- "1")),
- FinalOpts = [
- {cacertfile, CaCertFile},
- {depth, Depth},
- {verify, verify_peer}],
- % allows custom verify fun.
- case config:get("chttps",
- "verify_fun", nil) of
- nil -> FinalOpts;
- SpecStr ->
- FinalOpts
- ++ [{verify_fun, couch_httpd:make_arity_3_fun(SpecStr)}]
- end
- end
- end,
-
- [{port, Port},
- {ssl, true},
- {ssl_opts, FinalSslOpts}];
- false ->
io:format("SSL enabled but PEM certificates are missing.", []),
- throw({error, missing_certs})
+ throw({error, missing_certs});
+ false ->
+ ok
end,
+
+ ServerOpts = [Opt || {_, V}=Opt <- ServerOpts0, V /= nil],
+
+ ClientOpts = case config:get("ssl", "verify_ssl_certificates", "false") of
+ "false" ->
+ [];
+ "true" ->
+ [{depth, list_to_integer(config:get("ssl",
+ "ssl_certificate_max_depth", "1"))},
+ {verify, verify_peer}] ++
+ case config:get("ssl", "verify_fun", nil) of
+ nil -> [];
+ SpecStr ->
+ [{verify_fun, couch_httpd:make_arity_3_fun(SpecStr)}]
+ end
+ end,
+ SslOpts = ServerOpts ++ ClientOpts,
+
+ Options =
+ [{port, Port},
+ {ssl, true},
+ {ssl_opts, SslOpts}],
start_link(https, Options).
start_link(Name, Options) ->