tyler/proxmox-backup
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

proxy: factor out tls acceptor creation

Browse Source 
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
This commit is contained in:
Wolfgang Bumiller 2021-05-11 15:53:57 +02:00 committed by Thomas Lamprecht
parent b4931192c3
commit c381a162fb
1 changed files with 18 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
src/bin/proxmox-backup-proxy.rs
View File

@ -113,15 +113,11 @@ async fn run() -> Result<(), Error> {
let rest_server = RestServer::new(config); let rest_server = RestServer::new(config);
//openssl req -x509 -newkey rsa:4096 -keyout /etc/proxmox-backup/proxy.key -out /etc/proxmox-backup/proxy.pem -nodes //openssl req -x509 -newkey rsa:4096 -keyout /etc/proxmox-backup/proxy.key -out /etc/proxmox-backup/proxy.pem -nodes
let key_path = configdir!("/proxy.key");
let cert_path = configdir!("/proxy.pem");
let mut acceptor = SslAcceptor::mozilla_intermediate_v5(SslMethod::tls()).unwrap(); // we build the initial acceptor here as we cannot start if this fails - certificate reloads
acceptor.set_private_key_file(key_path, SslFiletype::PEM) // will be handled inside the accept loop and simply log an error if we cannot load the new
.map_err(|err| format_err!("unable to read proxy key {} - {}", key_path, err))?; // certificate!
acceptor.set_certificate_chain_file(cert_path) let acceptor = make_tls_acceptor()?;
.map_err(|err| format_err!("unable to read proxy cert {} - {}", cert_path, err))?;
acceptor.check_private_key().unwrap();
let acceptor = Arc::new(acceptor.build()); let acceptor = Arc::new(acceptor.build());
@ -170,6 +166,20 @@ async fn run() -> Result<(), Error> {
Ok(()) Ok(())
} }
fn make_tls_acceptor() -> Result<Arc<SslAcceptor>, Error> {
let key_path = configdir!("/proxy.key");
let cert_path = configdir!("/proxy.pem");
let mut acceptor = SslAcceptor::mozilla_intermediate_v5(SslMethod::tls()).unwrap();
acceptor.set_private_key_file(key_path, SslFiletype::PEM)
.map_err(|err| format_err!("unable to read proxy key {} - {}", key_path, err))?;
acceptor.set_certificate_chain_file(cert_path)
.map_err(|err| format_err!("unable to read proxy cert {} - {}", cert_path, err))?;
acceptor.check_private_key().unwrap();
Ok(Arc::new(acceptor.build()))
}
type ClientStreamResult = type ClientStreamResult =
Result<std::pin::Pin<Box<tokio_openssl::SslStream<tokio::net::TcpStream>>>, Error>; Result<std::pin::Pin<Box<tokio_openssl::SslStream<tokio::net::TcpStream>>>, Error>;
const MAX_PENDING_ACCEPTS: usize = 1024; const MAX_PENDING_ACCEPTS: usize = 1024;