Add client certificate support

mon/etcd_adapter.js

@@ -23,6 +23,10 @@ class EtcdAdapter
     parse_config(config)
     {
         this.parse_etcd_addresses(config.etcd_address||config.etcd_url);
+        if (config.etcd_client_cert)
+            this.opts.cert = fs.readFileSync(config.etcd_client_cert, { encoding: 'utf-8' });
+        if (config.etcd_client_key)
+            this.opts.key = fs.readFileSync(config.etcd_client_key, { encoding: 'utf-8' });
         if (config.etcd_ca)
             this.opts.ca = fs.readFileSync(config.etcd_ca, { encoding: 'utf-8' });
     }

mon/etcd_schema.js

@@ -45,7 +45,10 @@ const etcd_tree = {
             config_path: "/etc/vitastor/vitastor.conf",
             etcd_prefix: "/vitastor",
             // etcd connection - configurable online
-            etcd_address: "10.0.115.10:2379/v3",
+            etcd_address: "http://10.0.115.10:2379/v3",
+            etcd_client_cert: "",
+            etcd_client_key: "",
+            etcd_ca: "",
             // mon
             etcd_mon_ttl: 5, // min: 1
             etcd_mon_timeout: 1000, // ms. min: 0

src/client/etcd_state_client.cpp

@@ -245,6 +245,8 @@ void etcd_state_client_t::parse_config(const json11::Json & config)
             add_etcd_url(ea.string_value());
         }
     }
+    this->etcd_client_cert = config["etcd_client_cert"].string_value();
+    this->etcd_client_key = config["etcd_client_key"].string_value();
     this->etcd_ca = config["etcd_ca"].string_value();
     this->etcd_prefix = config["etcd_prefix"].string_value();
     if (this->etcd_prefix == "")

src/client/etcd_state_client.h

@@ -125,6 +125,8 @@ public:
     uint32_t global_immediate_commit = IMMEDIATE_NONE;
 
     std::string etcd_prefix;
+    std::string etcd_client_cert;
+    std::string etcd_client_key;
     std::string etcd_ca;
     int log_level = 0;
     timerfd_manager_t *tfd = NULL;

src/client/http_client.cpp

@@ -47,6 +47,8 @@ struct http_co_t
 
     int request_timeout = 0;
     bool ssl = false;
+    std::string ssl_cert;
+    std::string ssl_key;
     std::string ssl_ca;
     std::string host;
     std::string request;
@@ -392,6 +394,10 @@ void http_co_t::start_connection()
                 ? !SSL_CTX_load_verify_locations(ssl_ctx, ssl_ca.c_str(), NULL)
                 : !SSL_CTX_set_default_verify_paths(ssl_ctx))
                 goto init_err;
+            if (ssl_cert != "" && ssl_key != "" &&
+                (!SSL_CTX_use_certificate_file(ssl_ctx, ssl_cert.c_str(), SSL_FILETYPE_PEM) ||
+                !SSL_CTX_use_PrivateKey_file(ssl_ctx, ssl_key.c_str(), SSL_FILETYPE_PEM)))
+                goto init_err;
         }
         ssl_bio = BIO_new(BIO_s_socket());
         if (!ssl_bio)

src/client/http_client.h

@@ -23,6 +23,8 @@ struct http_options_t
     bool want_streaming;
     bool keepalive;
     bool ssl;
+    std::string ssl_cert;
+    std::string ssl_key;
     std::string ssl_ca;
 };