grpc plugin: Implement the VerifyPeer option for servers.

diff --git a/src/collectd.conf.in b/src/collectd.conf.in
index 4efa29e451844123338a70fb4af4fadc2d2c1042..2b54a6e2ffa34fba362a0f311b4ab7c5a116433e 100644 (file)
--- a/src/collectd.conf.in
+++ b/src/collectd.conf.in
@@ -643,6 +643,7 @@
 #              SSLCACertificateFile "/path/to/root.pem"
 #              SSLCertificateFile "/path/to/client.pem"
 #              SSLCertificateKeyFile "/path/to/client.key"
+#              VerifyPeer true
 #      </Listen>
 #</Plugin>
 

diff --git a/src/collectd.conf.pod b/src/collectd.conf.pod
index 0e7a604647106d72704f2f3478fcc2cbc15bce52..c8cd7e51ef51ee8c9e000cd11e48de86c89313bd 100644 (file)
--- a/src/collectd.conf.pod
+++ b/src/collectd.conf.pod
@@ -3094,6 +3094,13 @@ Whether to enable SSL for incoming connections. Default: false.
 Filenames specifying SSL certificate and key material to be used with SSL
 connections.
 
+=item B<VerifyPeer> B<true>|B<false>
+
+When enabled, a valid client certificate is required to connect to the server.
+When disabled, a client certifiacte is not requested and any unsolicited client
+certificate is accepted.
+Enabled by default.
+
 =back
 
 =back

diff --git a/src/grpc.cc b/src/grpc.cc
index 0f5cfec0427a7ef6e1f06f603208eb706017b40c..87ef754a3e5a1fb476170600c38c82ae3b8f83ff 100644 (file)
--- a/src/grpc.cc
+++ b/src/grpc.cc
@@ -626,7 +626,8 @@ static int c_grpc_config_listen(oconfig_item_t *ci) {
   listener.port = grpc::string(ci->values[1].value.string);
   listener.ssl = nullptr;
 
-  auto ssl_opts = new (grpc::SslServerCredentialsOptions);
+  auto ssl_opts = new grpc::SslServerCredentialsOptions(
+      GRPC_SSL_REQUEST_AND_REQUIRE_CLIENT_CERTIFICATE_AND_VERIFY);
   grpc::SslServerCredentialsOptions::PemKeyCertPair pkcp = {};
   bool use_ssl = false;
 
@@ -659,6 +660,14 @@ static int c_grpc_config_listen(oconfig_item_t *ci) {
         return -1;
       }
       pkcp.cert_chain = read_file(cert);
+    } else if (!strcasecmp("VerifyPeer", child->key)) {
+      _Bool verify = 0;
+      if (cf_util_get_boolean(child, &verify)) {
+        return -1;
+      }
+      ssl_opts->client_certificate_request =
+          verify ? GRPC_SSL_REQUEST_AND_REQUIRE_CLIENT_CERTIFICATE_AND_VERIFY
+                 : GRPC_SSL_DONT_REQUEST_CLIENT_CERTIFICATE;
     } else {
       WARNING("grpc: Option `%s` not allowed in <%s> block.", child->key,
               ci->key);