Add client certificate support

mon/etcd_adapter.js

@@ -23,6 +23,10 @@ class EtcdAdapter
     parse_config(config)
     {
         this.parse_etcd_addresses(config.etcd_address||config.etcd_url);
+        if (config.mon_etcd_client_cert || config.etcd_client_cert)
+            this.opts.cert = fs.readFileSync(config.mon_etcd_client_cert || config.etcd_client_cert, { encoding: 'utf-8' });
+        if (config.mon_etcd_client_key || config.etcd_client_key)
+            this.opts.key = fs.readFileSync(config.mon_etcd_client_key || config.etcd_client_key, { encoding: 'utf-8' });
         if (config.etcd_ca)
             this.opts.ca = fs.readFileSync(config.etcd_ca, { encoding: 'utf-8' });
     }

mon/etcd_schema.js

@@ -45,7 +45,10 @@ const etcd_tree = {
             config_path: "/etc/vitastor/vitastor.conf",
             etcd_prefix: "/vitastor",
             // etcd connection - configurable online
-            etcd_address: "10.0.115.10:2379/v3",
+            etcd_address: "http://10.0.115.10:2379/v3",
+            etcd_client_cert: "",
+            etcd_client_key: "",
+            etcd_ca: "",
             // mon
             etcd_mon_ttl: 5, // min: 1
             etcd_mon_timeout: 1000, // ms. min: 0

src/client/etcd_state_client.cpp

@@ -122,6 +122,16 @@ void etcd_state_client_t::parse_config(const json11::Json & config)
             add_etcd_url(ea.string_value());
         }
     }
+    if (this->osd_num)
+    {
+        this->etcd_client_cert = config["osd_etcd_client_cert"].string_value();
+        this->etcd_client_key = config["osd_etcd_client_key"].string_value();
+    }
+    else
+    {
+        this->etcd_client_cert = config["etcd_client_cert"].string_value();
+        this->etcd_client_key = config["etcd_client_key"].string_value();
+    }
     this->etcd_ca = config["etcd_ca"].string_value();
     this->etcd_prefix = config["etcd_prefix"].string_value();
     if (this->etcd_prefix == "")

src/client/etcd_state_client.h

@@ -121,7 +121,11 @@ public:
     uint64_t global_block_size = DEFAULT_BLOCK_SIZE;
     uint32_t global_bitmap_granularity = DEFAULT_BITMAP_GRANULARITY;
     uint32_t global_immediate_commit = IMMEDIATE_NONE;
+
+    uint64_t osd_num = 0;
     std::string etcd_prefix;
+    std::string etcd_client_cert;
+    std::string etcd_client_key;
     std::string etcd_ca;
     int log_level = 0;
 

src/client/http_client.cpp

@@ -47,6 +47,8 @@ struct http_co_t
 
     int request_timeout = 0;
     bool ssl = false;
+    std::string ssl_cert;
+    std::string ssl_key;
     std::string ssl_ca;
     std::string host;
     std::string request;
@@ -392,6 +394,10 @@ void http_co_t::start_connection()
                 ? !SSL_CTX_load_verify_locations(ssl_ctx, ssl_ca.c_str(), NULL)
                 : !SSL_CTX_set_default_verify_paths(ssl_ctx))
                 goto init_err;
+            if (ssl_cert != "" && ssl_key != "" &&
+                (!SSL_CTX_use_certificate_file(ssl_ctx, ssl_cert.c_str(), SSL_FILETYPE_PEM) ||
+                !SSL_CTX_use_PrivateKey_file(ssl_ctx, ssl_key.c_str(), SSL_FILETYPE_PEM)))
+                goto init_err;
         }
         ssl_bio = BIO_new(BIO_s_socket());
         if (!ssl_bio)

src/client/http_client.h

@@ -23,6 +23,8 @@ struct http_options_t
     bool want_streaming;
     bool keepalive;
     bool ssl;
+    std::string ssl_cert;
+    std::string ssl_key;
     std::string ssl_ca;
 };
 

src/osd/osd.cpp

@@ -174,6 +174,7 @@ void osd_t::parse_config(bool init)
         if (!osd_num)
             throw std::runtime_error("osd_num is required in the configuration");
         msgr.osd_num = osd_num;
+        st_cli->osd_num = osd_num;
     }
     if (bs)
     {