SSL support about lettuce

[mp911de]

Support SSL on plain Redis Connections. Connect over sentinal and cluster are excluded because sentinel and cluster provide adresses by a redis-internal registry, external SSL port/address cannot be obtained for now.

Conneciton flags:

• SSL true/false
• StartTLS true/false
• Verify Peer true/false (omit certificate validity/hostname check)

[mp911de]

Left todo:

• SSL Connection Builder
• Tests
• Create keys at build (in Makefile)
• Conditional tests with -Djavax.net.ssl.trustStore=keystore.jks
• Stunnel conf
• Setup stunnel in travis/snap-ci build. Should support Mac and *NIX for local build, too

stunnel.conf

cert = cert.pem
key = key.pem
capath = cert.pem
delay = yes
foreground = false

[redis]
accept = 127.0.0.1:6443
connect = 127.0.0.1:6479

Gen key/Import key to JKS

openssl genrsa -out key.pem 4096
openssl req -new -x509 -key key.pem -out cert.pem -days 1826 -subject "/O=lettuce/ST=Some-State/C=DE/CN=lettuce-test"
keytool -importcert -keystore keystore.jks -file stunnel/cert.pem -noprompt -storepass changeit

SSL Pseudo-Code

sslContext with InsecureTrustManagerFactory if verify == false
SSLEngine sslEngine = sslCtx.newEngine(ch.alloc(), isa.getHostString(), isa.getPort());
if(verify){
SSLParameters sslParams = new SSLParameters();
sslParams.setEndpointIdentificationAlgorithm("HTTPS");
sslEngine.setSSLParameters(sslParams);
}

[mp911de]

@kichik Pushed some SSL changes towards branch issue-28-ssl-support. Do you want to sneek peek?

[mp911de]

Build support done, connect waits for successful handshake. Still thinking about reconnect. A disconnect will lead to a reconnect, but if the remote peer will not validate against SSL rules (e. g. peer verification) this will end up in a endless loop. URI parser and docs need update too.

[kichik]

Thanks. I can help you test if you want, but I don't think I will use this in production. I do think it's super useful and should be merged to master, but we just have a few extra requirements that are already satisfied with the current solution. That said, I think access to SSLParams would provide even more flexibility.

[mp911de]

Thanks for your offer, would be great having someone else testing. SSL provides lots of fancy stuff (allowed ciphers, client certs and many more). I'd release the first version with basic SSL support, and I'm thinking on something that allows flexibility without adding unneccessary complexity.

[mp911de]

SSL support implemented