SSL Client support

[mnunberg]

This provides SSL client support for communicating with an SSL-secured Redis implementation. The user-facing API is exposed as bolted-on, which makes modifying existing applications easier. This works in my basic testing so far.

The SSL implementation assumes mutual TLS auth. SSL support is disabled by default at compilation. To use SSL, set USE_SSL in the build environment.

$make USE_SSL=1

This should enable the HIREDIS_SSL preprocessor define, which should enable the SSL bits. Note that you may want to also adjust your OPENSSL_PREFIX build variable to your desired openssl installation. This is probably only a concern for OSX where there are typically both Homebrew and Apple variants provided. On linux there should only be a single version found in /usr/lib/ or similar. The default value is /opt/local/openssl.

Once the library is built, you should be able to call

int redisSecureConnection(redisContext *c, const char *capath, const char *certpath,
                          const char *keypath);

On the connection. This will perform openssl negotiation. The reason I didn't provide another variant of redisConnect is twofold. (1) I wanted other applications to be able to simply add (rather than change) their existing connection code - so this also works via fd etc. (2) Users can quickly debug if an error is coming from the connection layer or openssl layer.

I've also added examples (the sync example and the libev and libevent examples).

[mnunberg]

@michael-grunder Any thoughts on this? I've been asked to revive this

[michael-grunder]

I'm not opposed to adding SSL support.

There was a great deal of back and forth around this issue in Redis proper, so we may want to run it by @antirez to see if he has any objections.

I'm happy to help test as well.

[drpalaric]

Is there any future for this?

[mnunberg]

Yes, in fact SSL is actively being used in some deployments! - however I need to cut out some time to properly integrate it in hiredis for public consumption.

…

On Jan 24, 2019, at 4:52 PM, Abdullah Alger ***@***.***> wrote: Is there any future for this? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#570 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAanUV5LkZzkPiBdr_pcxL1DN88B6qY-ks5vGis5gaJpZM4RXupJ>.

[mnunberg]

I'm closing this PR in favor of #645