Add support for setting SSL verification mode

[ben-palmer-sociomantic]

Currently the SSL connections in libdrizzle-redux do not support setting the verification mode for the SSL connection (https://www.openssl.org/docs/man1.0.2/ssl/SSL_CTX_set_verify.html).

This should be set when setting up the SSL settings (

libdrizzle-redux/src/ssl.cc

Lines 49 to 90 in 597d2be

	con->ssl_context= SSL_CTX_new(TLSv1_client_method());
	if (cipher)
	{
	drizzle_set_error(con, __FILE_LINE_FUNC__, "Cannot set the SSL cipher list");
	return DRIZZLE_RETURN_SSL_ERROR;
	}
	if (SSL_CTX_load_verify_locations((SSL_CTX*)con->ssl_context, ca, capath) != 1)
	{
	drizzle_set_error(con, __FILE_LINE_FUNC__, "Cannot load the SSL certificate authority file");
	return DRIZZLE_RETURN_SSL_ERROR;
	}
	if (cert)
	{
	if (SSL_CTX_use_certificate_file((SSL_CTX*)con->ssl_context, cert, SSL_FILETYPE_PEM) != 1)
	{
	drizzle_set_error(con, __FILE_LINE_FUNC__, "Cannot load the SSL certificate file");
	return DRIZZLE_RETURN_SSL_ERROR;
	}
	if (!key)
	key= cert;
	if (SSL_CTX_use_PrivateKey_file((SSL_CTX*)con->ssl_context, key, SSL_FILETYPE_PEM) != 1)
	{
	drizzle_set_error(con, __FILE_LINE_FUNC__, "Cannot load the SSL key file");
	return DRIZZLE_RETURN_SSL_ERROR;
	}
	if (SSL_CTX_check_private_key((SSL_CTX*)con->ssl_context) != 1)
	{
	drizzle_set_error(con, __FILE_LINE_FUNC__, "Error validating the SSL private key");
	return DRIZZLE_RETURN_SSL_ERROR;
	}
	}
	con->ssl= SSL_new((SSL_CTX*)con->ssl_context);
	return DRIZZLE_RETURN_OK;
	}

).

Exception handling will need to be added for error conditions.

[andreas-bok-sociomantic]

It seems like the SSL support in libdrizzle-redux is rather outdated and possibly not working.
Setting up the encrypted connection with drizzle_set_ssl and connecting fails with:

drizzle_state_handshake_client_write:SSL error: 1 - error:1409F080: SSL routines:ssl3_write_pending: bio not set(DRIZZLE_RETURN_SSL_ERROR) ]

Thus it will require a more thorough review of the SSL support to get SSL_CTX_set_verify to work.

[andreas-bok-sociomantic]

I discussed the implementation of support for encrypted connections with @nemanja-boric-sociomantic.
Apart from the need to set the SSL verification mode other issues must be addressed as well to fix the openssl support. I will create separate issues for these.

[ben-palmer-sociomantic]

Apart from the need to set the SSL verification mode other issues must be addressed as well to fix the openssl support.

Are these other fixes required to get a basic encrypted connection with no authentication?

[nemanja-boric-sociomantic]

The biggest issue is that libdrizzle doesn't support encrypted non-blocking reads/writes, which is a huge blocker. Nevertheless, I think it can be adapted to allow that.

[ben-palmer-sociomantic]

Ok yeah that is a bit of a big problem.