xCAT/confluent
2
0
Fork 0
mirror of https://github.com/xcat2/confluent.git synced 2024-11-22 01:22:00 +00:00
Code Issues Projects Releases Wiki Activity

Defer ssl wrap until after accept()

Browse Source 
ssl wrap prior to accept causes accept() to be too complicated to stay in the
persistent thread and makes key changes require restart to pickup.  Call
the wrap_socket within the dedicated client thread so that it gets up to date
at the right time and picks up certificate changes in a timely fashion.
This commit is contained in:
Jarrod Johnson 2014-05-20 09:41:55 -04:00
parent b78830c403
commit 38f07252f8
1 changed files with 11 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
confluent_server/confluent/sockapi.py
View File

@ -197,16 +197,20 @@ def _tlshandler():
plainsocket = socket.socket(socket.AF_INET6)
plainsocket.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
plainsocket.setsockopt(socket.IPPROTO_TCP, socket.TCP_NODELAY, 1)
srv = ssl.wrap_socket(plainsocket, keyfile="/etc/confluent/privkey.pem",
plainsocket.bind(('::', 13001, 0, 0))
plainsocket.listen(5)
while (1): # TODO: exithook
cnn, addr = plainsocket.accept()
eventlet.spawn_n(_tlsstartup, cnn)
def _tlsstartup(cnn):
authname = None
cnn = ssl.wrap_socket(cnn, keyfile="/etc/confluent/privkey.pem",
certfile="/etc/confluent/srvcert.pem",
ssl_version=ssl.PROTOCOL_TLSv1,
server_side=True)
srv.bind(('::', 13001, 0, 0))
srv.listen(5)
authname = None
while (1): # TODO: exithook
cnn, addr = srv.accept()
eventlet.spawn_n(sessionhdl, cnn, authname)
sessionhdl(cnn, authname)
def _unixdomainhandler():