Merge lp:~brianaker/gearmand/ssl-update into lp:gearmand

[Brian Aker]

[lp:~brianaker/gearmand/ssl-update]

805. By Tangent.Org Continuous Integration on 2013-07-06

Merge lp:~brianaker/gearmand/ssl-update Build: jenkins-Gearmand-703

=== modified file 'Makefile.am'
--- Makefile.am	2013-06-05 21:59:31 +0000
+++ Makefile.am	2013-07-06 00:44:27 +0000
@@ -78,8 +78,8 @@
 	  echo '#define GEARMAND_CA_CERTIFICATE "$(sysconfdir)/ssl/certs/gearmand-ca.pem"'; \
 	  echo '#define GEARMAND_SERVER_PEM "$(sysconfdir)/ssl/certs/gearmand.pem"'; \
 	  echo '#define GEARMAND_SERVER_KEY "$(sysconfdir)/ssl/certs/gearmand.key"'; \
-	  echo '#define GEARMAND_CLIENT_PEM "$(sysconfdir)/ssl/certs/gearman.pem"'; \
-	  echo '#define GEARMAND_CLIENT_KEY "$(sysconfdir)/ssl/certs/gearman.key"'; \
+	  echo '#define GEARMAN_CLIENT_PEM "$(sysconfdir)/ssl/certs/gearman.pem"'; \
+	  echo '#define GEARMAN_CLIENT_KEY "$(sysconfdir)/ssl/certs/gearman.key"'; \
 	  echo '#define LOCALSTATEDIR "$(localstatedir)"'; \
 	  echo '#define GEARMAND_PID "$(localstatedir)/gearmand.pid"'; \
 	  } | sed '/""/d' > $@-t

=== modified file 'configure.ac'
--- configure.ac	2013-06-30 22:09:00 +0000
+++ configure.ac	2013-07-06 00:44:27 +0000
@@ -226,15 +226,23 @@
 # Check for CyaSSL
 AC_DEFUN([AX_ENABLE_SSL],
          [AC_PREREQ([2.63])dnl
+         m4_define([_SSL_ENABLE_DEFAULT], [m4_if($1, no, no, no)])dnl
          AC_ARG_ENABLE([ssl],
                        [AS_HELP_STRING([--enable-ssl],
-                                       [Enable ssl support for Gearman --enable-debug (yes|no) @<:@default=no@:>@])],
-                                       [AX_CHECK_LIBRARY([CYASSL],[cyassl/ssl.h],[cyassl])],
-                                       [AC_MSG_WARN([ssl will not be enabled])])
+                                       [Enable ssl support for Gearman @<:@default=]_SSL_ENABLE_DEFAULT[@:>@])],
+                                       [AS_CASE([$enableval],
+                                                [yes],[enable_ssl=yes],
+                                                [no],[enable_ssl=no],
+                                                [enable_ssl=no])
+                                        ],
+                                        [enable_ssl=]_SSL_ENABLE_DEFAULT)
+         AS_IF([test "x${enable_ssl}" = "xyes"],
+               [AX_CHECK_LIBRARY([CYASSL],[cyassl/ssl.h],[cyassl],[],
+                                 [AC_MSG_ERROR([Unable to find cyassl])
+                                 enable_ssl=no])])
          ])
 AX_ENABLE_SSL
-#AC_SUBST([CYASSL])
-#AC_SUBST([CYASSL_LIB])
+
 AX_ENABLE_LIBMEMCACHED
 
 AC_DEFINE([GEARMAND_BLOBSLAP_WORKER],[1],[Have Gearman Blobslap Worker])

=== modified file 'libgearman-server/io.cc'
--- libgearman-server/io.cc	2013-06-26 23:50:02 +0000
+++ libgearman-server/io.cc	2013-07-06 00:44:27 +0000
@@ -242,6 +242,7 @@
       return GEARMAND_ERRNO;
 
     case gearmand_io_st::GEARMAND_CON_UNIVERSAL_CONNECTED:
+      uint32_t loop_counter= 0;
       while (connection->send_buffer_size)
       {
         ssize_t write_size;
@@ -249,6 +250,37 @@
         if (con->_ssl)
         {
           write_size= CyaSSL_send(con->_ssl, connection->send_buffer_ptr, connection->send_buffer_size, MSG_NOSIGNAL|MSG_DONTWAIT);
+
+          // I consider this to be a bug in CyaSSL_send() that is uses a zero in this manner
+          if (write_size <= 0)
+          {
+            int err;
+            switch ((err= CyaSSL_get_error(con->_ssl, write_size)))
+            {
+              case SSL_ERROR_WANT_CONNECT:
+              case SSL_ERROR_WANT_ACCEPT:
+                write_size= -1;
+                errno= EAGAIN;
+                break;
+
+              case SSL_ERROR_WANT_WRITE:
+              case SSL_ERROR_WANT_READ:
+                write_size= -1;
+                errno= EAGAIN;
+                break;
+
+              default:
+                {
+                  char errorString[80];
+                  CyaSSL_ERR_error_string(err, errorString);
+                  _connection_close(connection);
+                  return gearmand_log_gerror(GEARMAN_DEFAULT_LOG_PARAM, GEARMAND_LOST_CONNECTION, "%s:%s SSL failure(%s)",
+                                             connection->context == NULL ? "-" : connection->context->host,
+                                             connection->context == NULL ? "-" : connection->context->port,
+                                             errorString);
+                }
+            }
+          }
         }
         else
 #endif
@@ -258,9 +290,17 @@
 
         if (write_size == 0) // detect infinite loop?
         {
-          gearmand_log_debug(GEARMAN_DEFAULT_LOG_PARAM, "send() sent zero bytes to peer %s:%s",
+          ++loop_counter;
+          gearmand_log_debug(GEARMAN_DEFAULT_LOG_PARAM, "send() sent zero bytes of %u to peer %s:%s",
+                             uint32_t(connection->send_buffer_size),
                              connection->context == NULL ? "-" : connection->context->host,
                              connection->context == NULL ? "-" : connection->context->port);
+
+          if (loop_counter > 5)
+          {
+            _connection_close(connection);
+            return gearmand_log_gerror(GEARMAN_DEFAULT_LOG_PARAM, GEARMAND_LOST_CONNECTION, "send() failed to send data");
+          }
           continue;
         }
         else if (write_size == -1)
@@ -268,6 +308,9 @@
           int local_errno= errno;
           switch (local_errno)
           {
+#if defined(EWOULDBLOCK) && EWOULDBLOCK != EAGAIN
+          case EWOULDBLOCK:
+#endif
           case EAGAIN:
             {
               gearmand_error_t gret= gearmand_io_set_events(con, POLLOUT);
@@ -706,7 +749,10 @@
         }
         return ret;
       }
-      gearmand_log_debug(GEARMAN_DEFAULT_LOG_PARAM, "read %lu bytes", (unsigned long)recv_size);
+      gearmand_log_debug(GEARMAN_DEFAULT_LOG_PARAM, "%s:%s read %lu bytes",
+                         connection->context == NULL ? "-" : connection->context->host,
+                         connection->context == NULL ? "-" : connection->context->port,
+                         (unsigned long)recv_size);
 
       connection->recv_buffer_size+= recv_size;
     }
@@ -927,24 +973,25 @@
 
 void gearmand_sockfd_close(int& sockfd)
 {
-  if (sockfd == INVALID_SOCKET)
-  {
-    gearmand_error("gearmand_sockfd_close() called with an invalid socket");
-    return;
-  }
-
-  /* in case of death shutdown to avoid blocking at close() */
-  if (shutdown(sockfd, SHUT_RDWR) == SOCKET_ERROR && get_socket_errno() != ENOTCONN)
-  {
-    gearmand_perror(errno, "shutdown");
-    assert(errno != ENOTSOCK);
-  }
-  else if (closesocket(sockfd) == SOCKET_ERROR)
-  {
-    gearmand_perror(errno, "close");
-  }
-
-  sockfd= INVALID_SOCKET;
+  if (sockfd != INVALID_SOCKET)
+  {
+    /* in case of death shutdown to avoid blocking at close() */
+    if (shutdown(sockfd, SHUT_RDWR) == SOCKET_ERROR && get_socket_errno() != ENOTCONN)
+    {
+      gearmand_perror(errno, "shutdown");
+      assert(errno != ENOTSOCK);
+    }
+    else if (closesocket(sockfd) == SOCKET_ERROR)
+    {
+      gearmand_perror(errno, "close");
+    }
+
+    sockfd= INVALID_SOCKET;
+  }
+  else
+  {
+    gearmand_warning("gearmand_sockfd_close() called with an invalid socket");
+  }
 }
 
 void gearmand_pipe_close(int& pipefd)

=== modified file 'libgearman-server/log.cc'
--- libgearman-server/log.cc	2013-06-10 22:49:06 +0000
+++ libgearman-server/log.cc	2013-07-06 00:44:27 +0000
@@ -116,6 +116,26 @@
   return GEARMAND_INVALID_ARGUMENT;
 }
 
+static gearmand_error_t __errno_to_gearmand_error_t(int local_errno)
+{
+  gearmand_error_t error_to_report= GEARMAND_ERRNO;
+
+  switch (local_errno)
+  {
+  case ENOMEM:
+    error_to_report= GEARMAND_MEMORY_ALLOCATION_FAILURE;
+
+  case ECONNRESET:
+  case EHOSTDOWN:
+    error_to_report= GEARMAND_LOST_CONNECTION;
+
+  default:
+    break;
+  }
+
+  return error_to_report;
+}
+
 /**
  * Log a message.
  *
@@ -303,20 +323,7 @@
     }
   }
 
-  switch (local_errno)
-  {
-  case ENOMEM:
-    return GEARMAND_MEMORY_ALLOCATION_FAILURE;
-
-  case ECONNRESET:
-  case EHOSTDOWN:
-    return GEARMAND_LOST_CONNECTION;
-
-  default:
-    break;
-  }
-
-  return GEARMAND_ERRNO;
+  return __errno_to_gearmand_error_t(local_errno);
 }
 
 gearmand_error_t gearmand_log_error(const char *position, const char *function, const char *format, ...)
@@ -415,20 +422,7 @@
     }
   }
 
-  switch (local_errno)
-  {
-  case ENOMEM:
-    return GEARMAND_MEMORY_ALLOCATION_FAILURE;
-
-  case ECONNRESET:
-  case EHOSTDOWN:
-    return GEARMAND_LOST_CONNECTION;
-
-  default:
-    break;
-  }
-
-  return GEARMAND_ERRNO;
+  return __errno_to_gearmand_error_t(local_errno);
 }
 
 gearmand_error_t gearmand_log_gerror(const char *position, const char *function, const gearmand_error_t rc, const char *format, ...)

=== modified file 'libgearman-server/plugins/protocol/gear/protocol.cc'
--- libgearman-server/plugins/protocol/gear/protocol.cc	2013-06-30 02:48:43 +0000
+++ libgearman-server/plugins/protocol/gear/protocol.cc	2013-07-06 00:44:27 +0000
@@ -312,7 +312,7 @@
   {
     if ((connection->_ssl= CyaSSL_new(Gearmand()->ctx_ssl())) == NULL)
     {
-      return gearmand_log_error(GEARMAN_DEFAULT_LOG_PARAM, "CyaSSL_new() failed");
+      return gearmand_log_gerror(GEARMAN_DEFAULT_LOG_PARAM, GEARMAND_MEMORY_ALLOCATION_FAILURE, "CyaSSL_new() failed to return a valid object");
     }
 
     CyaSSL_set_fd(connection->_ssl, connection->con.fd);
@@ -331,7 +331,7 @@
         int cyassl_error= CyaSSL_get_error(connection->_ssl, 0);
         char cyassl_error_buffer[1024]= { 0 };
         CyaSSL_ERR_error_string(cyassl_error, cyassl_error_buffer);
-        return gearmand_log_error(GEARMAN_DEFAULT_LOG_PARAM, "%s(%d)", cyassl_error_buffer, cyassl_error);
+        return gearmand_log_gerror(GEARMAN_DEFAULT_LOG_PARAM, GEARMAND_LOST_CONNECTION, "%s(%d)", cyassl_error_buffer, cyassl_error);
       }
     }
     gearmand_log_info(GEARMAN_DEFAULT_LOG_PARAM, "GearSSL connection made: %d", connection->con.fd);
@@ -349,6 +349,9 @@
 Gear::Gear() :
   Plugin("Gear"),
   _port(GEARMAN_DEFAULT_TCP_PORT_STRING),
+  _ssl_ca_file(GEARMAND_CA_CERTIFICATE),
+  _ssl_certificate(GEARMAND_SERVER_PEM),
+  _ssl_key(GEARMAND_SERVER_KEY),
   opt_ssl(false)
   {
     command_line_options().add_options()
@@ -356,6 +359,12 @@
        "Port the server should listen on.")
       ("ssl", boost::program_options::bool_switch(&opt_ssl)->default_value(false),
        "Enable ssl connections.")
+      ("ssl-ca-file", boost::program_options::value(&_ssl_ca_file),
+       "CA file.")
+      ("ssl-certificate", boost::program_options::value(&_ssl_certificate),
+       "SSL certificate.")
+      ("ssl-key", boost::program_options::value(&_ssl_key),
+       "SSL key for certificate.")
       ;
   }
 
@@ -400,20 +409,23 @@
   {
     gearmand->init_ssl();
 
-    if (CyaSSL_CTX_load_verify_locations(gearmand->ctx_ssl(), GEARMAND_CA_CERTIFICATE, 0) != SSL_SUCCESS)
+    if (CyaSSL_CTX_load_verify_locations(gearmand->ctx_ssl(), _ssl_ca_file.c_str(), 0) != SSL_SUCCESS)
     {
-      gearmand_log_fatal(GEARMAN_DEFAULT_LOG_PARAM, "CyaSSL_CTX_load_verify_locations() cannot local the ca certificate %s", GEARMAND_CA_CERTIFICATE);
-    }
-
-    if (CyaSSL_CTX_use_certificate_file(gearmand->ctx_ssl(), GEARMAND_SERVER_PEM, SSL_FILETYPE_PEM) != SSL_SUCCESS)
-    {   
-      gearmand_log_fatal(GEARMAN_DEFAULT_LOG_PARAM, "CyaSSL_CTX_use_certificate_file() cannot obtain certificate %s", GEARMAND_SERVER_PEM);
-    }
-
-    if (CyaSSL_CTX_use_PrivateKey_file(gearmand->ctx_ssl(), GEARMAND_SERVER_KEY, SSL_FILETYPE_PEM) != SSL_SUCCESS)
-    {   
-      gearmand_log_fatal(GEARMAN_DEFAULT_LOG_PARAM, "CyaSSL_CTX_use_PrivateKey_file() cannot obtain certificate %s", GEARMAND_SERVER_KEY);
-    }
+      gearmand_log_fatal(GEARMAN_DEFAULT_LOG_PARAM, "CyaSSL_CTX_load_verify_locations() cannot local the ca certificate %s", _ssl_ca_file.c_str());
+    }
+    gearmand_log_info(GEARMAN_DEFAULT_LOG_PARAM, "Loading CA certificate : %s", _ssl_ca_file.c_str());
+
+    if (CyaSSL_CTX_use_certificate_file(gearmand->ctx_ssl(), _ssl_certificate.c_str(), SSL_FILETYPE_PEM) != SSL_SUCCESS)
+    {   
+      gearmand_log_fatal(GEARMAN_DEFAULT_LOG_PARAM, "CyaSSL_CTX_use_certificate_file() cannot obtain certificate %s", _ssl_certificate.c_str());
+    }
+    gearmand_log_info(GEARMAN_DEFAULT_LOG_PARAM, "Loading certificate : %s", _ssl_certificate.c_str());
+
+    if (CyaSSL_CTX_use_PrivateKey_file(gearmand->ctx_ssl(), _ssl_key.c_str(), SSL_FILETYPE_PEM) != SSL_SUCCESS)
+    {   
+      gearmand_log_fatal(GEARMAN_DEFAULT_LOG_PARAM, "CyaSSL_CTX_use_PrivateKey_file() cannot obtain certificate %s", _ssl_key.c_str());
+    }
+    gearmand_log_info(GEARMAN_DEFAULT_LOG_PARAM, "Loading certificate key : %s", _ssl_key.c_str());
 
     assert(gearmand->ctx_ssl());
   }

=== modified file 'libgearman-server/plugins/protocol/gear/protocol.h'
--- libgearman-server/plugins/protocol/gear/protocol.h	2013-06-05 21:59:31 +0000
+++ libgearman-server/plugins/protocol/gear/protocol.h	2013-07-06 00:44:27 +0000
@@ -58,6 +58,9 @@
 
 private:
   std::string _port;
+  std::string _ssl_ca_file;
+  std::string _ssl_certificate;
+  std::string _ssl_key;
   bool opt_ssl;
 };
 

=== modified file 'libgearman/client.hpp'
--- libgearman/client.hpp	2013-03-15 21:54:07 +0000
+++ libgearman/client.hpp	2013-07-06 00:44:27 +0000
@@ -56,6 +56,8 @@
     {
       throw std::runtime_error("gearman_client_create() failed");
     }
+
+    enable_ssl();
   }
 
   Client(const gearman_client_st* arg)
@@ -66,6 +68,8 @@
     {
       throw std::runtime_error("gearman_client_create() failed");
     }
+
+    enable_ssl();
   }
 
   Client(in_port_t arg)
@@ -77,6 +81,8 @@
       throw std::runtime_error("gearman_client_create() failed");
     }
     gearman_client_add_server(_client, "localhost", arg);
+
+    enable_ssl();
   }
 
   gearman_client_st* operator&() const
@@ -94,6 +100,14 @@
     gearman_client_free(_client);
   }
 
+  void enable_ssl()
+  { 
+    if (getenv("GEARMAND_CA_CERTIFICATE"))
+    {
+      gearman_client_add_options(_client, GEARMAN_CLIENT_SSL);
+    }
+  }
+
 private:
   gearman_client_st *_client;
 

=== modified file 'libgearman/connection.cc'
--- libgearman/connection.cc	2013-06-30 05:13:06 +0000
+++ libgearman/connection.cc	2013-07-06 00:44:27 +0000
@@ -821,14 +821,21 @@
         if (_ssl)
         {
           write_size= CyaSSL_send(_ssl, send_buffer_ptr, send_buffer_size, MSG_NOSIGNAL);
-          if (write_size < 0)
+          if (write_size <= 0)
           {
             int err;
-            switch ((err= CyaSSL_get_error(_ssl, 0)))
+            switch ((err= CyaSSL_get_error(_ssl, write_size)))
             {
+              case SSL_ERROR_WANT_CONNECT:
+              case SSL_ERROR_WANT_ACCEPT:
+                write_size= -1;
+                errno= EAGAIN;
+                break;
+
               case SSL_ERROR_WANT_WRITE:
               case SSL_ERROR_WANT_READ:
-                errno= EWOULDBLOCK;
+                write_size= -1;
+                errno= EAGAIN;
                 break;
 
               default:
@@ -1069,6 +1076,7 @@
 
   if (data_size != recv_size)
   {
+    // @note fix this to test for error before blindly doing this opperation
     recv_size+= recv_socket(static_cast<uint8_t *>(const_cast<void *>(data)) + recv_size, data_size - recv_size, ret);
     recv_data_offset+= recv_size;
   }
@@ -1098,9 +1106,9 @@
     if (_ssl)
     {
       read_size= CyaSSL_recv(_ssl, data, data_size, MSG_DONTWAIT);
-      if (read_size < 0)
+      if (read_size <= 0)
       {
-        int sendErr= CyaSSL_get_error(_ssl, 0);
+        int sendErr= CyaSSL_get_error(_ssl, read_size);
         if (sendErr != SSL_ERROR_WANT_READ)
         {
           char errorString[80];

=== modified file 'libgearman/error.hpp'
--- libgearman/error.hpp	2013-07-02 23:51:10 +0000
+++ libgearman/error.hpp	2013-07-06 00:44:27 +0000
@@ -40,7 +40,7 @@
 
 #define STRINGIFY(x) #x
 #define TOSTRING(x) STRINGIFY(x)
-#define AT __FILE__ ":" TOSTRING(__LINE__)
+#define AT __FILE__ ":" TOSTRING(__LINE__) ":"
 #define GEARMAN_AT __func__, AT
 
 #define gearman_perror(__universal, __message) gearman_universal_set_perror((__universal), __func__, AT, (__message))

=== modified file 'libgearman/interface/universal.hpp'
--- libgearman/interface/universal.hpp	2013-06-05 21:59:31 +0000
+++ libgearman/interface/universal.hpp	2013-07-06 00:44:27 +0000
@@ -43,6 +43,7 @@
 #include "libgearman/interface/packet.hpp"
 #include "libgearman/vector.h" 
 #include "libgearman/assert.hpp" 
+#include "libgearman/ssl.h"
 
 enum universal_options_t
 {
@@ -201,20 +202,59 @@
         options_++;
       }
     }
-
-    // Only does something if SSL has been enabled.
-    bool ret= init_ssl();
-    if (ret == false)
-    {
-      abort();
-    }
-  }
-
+  }
+
+  const char* ssl_ca_file() const
+  {
+    if (getenv("GEARMAND_CA_CERTIFICATE"))
+    {
+      return getenv("GEARMAND_CA_CERTIFICATE");
+    }
+
+    return GEARMAND_CA_CERTIFICATE;
+  }
+
+  const char* ssl_certificate() const
+  {
+    if (getenv("GEARMAN_CLIENT_PEM"))
+    {
+      return getenv("GEARMAN_CLIENT_PEM");
+    }
+
+    return GEARMAN_CLIENT_PEM;
+  }
+
+  const char* ssl_key() const
+  {
+    if (getenv("GEARMAN_CLIENT_KEY"))
+    {
+      return getenv("GEARMAN_CLIENT_KEY");
+    }
+
+    return GEARMAN_CLIENT_KEY;
+  }
+
+private:
   bool init_ssl();
 
+public:
   struct CYASSL_CTX* ctx_ssl() 
   {
-    return _ctx_ssl;
+    if (ssl())
+    {
+      if (_ctx_ssl == NULL)
+      {
+        if (init_ssl() == false)
+        {
+          abort();
+        }
+      }
+      assert(_ctx_ssl);
+
+      return _ctx_ssl;
+    }
+
+    return NULL;
   }
 
   ~gearman_universal_st();

=== modified file 'libgearman/ostream.hpp'
--- libgearman/ostream.hpp	2012-11-12 06:50:33 +0000
+++ libgearman/ostream.hpp	2013-07-06 00:44:27 +0000
@@ -43,6 +43,7 @@
 static inline std::ostream& operator<<(std::ostream& output, const gearman_packet_st &arg)
 {
   const char* command_str;
+  // gearman_strcommand()
   switch(arg.command)
   {
   case GEARMAN_COMMAND_TEXT: command_str=  "GEARMAN_COMMAND_TEXT";

=== modified file 'libgearman/ssl.h'
--- libgearman/ssl.h	2013-06-05 21:59:31 +0000
+++ libgearman/ssl.h	2013-07-06 00:44:27 +0000
@@ -42,8 +42,3 @@
 #endif
 
 #include "configmake.h"
-
-#define CA_CERT_PEM GEARMAND_CA_CERTIFICATE
-#define CERT_PEM GEARMAND_CLIENT_PEM
-#define CERT_KEY_PEM GEARMAND_CLIENT_PEM
-

=== modified file 'libgearman/universal.cc'
--- libgearman/universal.cc	2013-07-02 23:16:11 +0000
+++ libgearman/universal.cc	2013-07-06 00:44:27 +0000
@@ -409,6 +409,8 @@
   {
     CyaSSL_CTX_free(_ctx_ssl);
   }
+#else
+  assert(_ctx_ssl == NULL);
 #endif
 }
 
@@ -438,32 +440,32 @@
 
 bool gearman_universal_st::init_ssl()
 {
-  if (options._ssl)
+  if (ssl())
   {
 #if defined(HAVE_CYASSL) && HAVE_CYASSL
     CyaSSL_Init();
 
-    if ((_ctx_ssl = CyaSSL_CTX_new(CyaTLSv1_client_method())) == NULL)
-    {
-      gearman_error(*this, GEARMAN_INVALID_ARGUMENT, "CyaTLSv1_client_method()");
-      return false;
-    }
-
-    if (CyaSSL_CTX_load_verify_locations(_ctx_ssl, GEARMAND_CA_CERTIFICATE, 0) != SSL_SUCCESS)
-    {
-      gearman_error(*this, GEARMAN_INVALID_ARGUMENT, CA_CERT_PEM);
-      return false;
-    }
-
-    if (CyaSSL_CTX_use_certificate_file(_ctx_ssl, GEARMAND_CLIENT_PEM, SSL_FILETYPE_PEM) != SSL_SUCCESS)
-    {   
-      gearman_error(*this, GEARMAN_INVALID_ARGUMENT, CERT_PEM);
-      return false;
-    }
-
-    if (CyaSSL_CTX_use_PrivateKey_file(_ctx_ssl, GEARMAND_CLIENT_KEY, SSL_FILETYPE_PEM) != SSL_SUCCESS)
-    {   
-      gearman_error(*this, GEARMAN_INVALID_ARGUMENT, CERT_KEY_PEM);
+    if ((_ctx_ssl= CyaSSL_CTX_new(CyaTLSv1_client_method())) == NULL)
+    {
+      gearman_universal_set_error(*this, GEARMAN_INVALID_ARGUMENT, GEARMAN_AT, "CyaTLSv1_client_method() failed");
+      return false;
+    }
+
+    if (CyaSSL_CTX_load_verify_locations(_ctx_ssl, ssl_ca_file(), 0) != SSL_SUCCESS)
+    {
+      gearman_universal_set_error(*this, GEARMAN_INVALID_ARGUMENT, GEARMAN_AT, "Failed to load CA certificate %s", ssl_ca_file());
+      return false;
+    }
+
+    if (CyaSSL_CTX_use_certificate_file(_ctx_ssl, ssl_certificate(), SSL_FILETYPE_PEM) != SSL_SUCCESS)
+    {   
+      gearman_universal_set_error(*this, GEARMAN_INVALID_ARGUMENT, GEARMAN_AT, "Failed to load certificate %s", ssl_certificate());
+      return false;
+    }
+
+    if (CyaSSL_CTX_use_PrivateKey_file(_ctx_ssl, ssl_key(), SSL_FILETYPE_PEM) != SSL_SUCCESS)
+    {   
+      gearman_universal_set_error(*this, GEARMAN_INVALID_ARGUMENT, GEARMAN_AT, "Failed to load certificate key %s", ssl_key());
       return false;
     }
 #endif // defined(HAVE_CYASSL) && HAVE_CYASSL

=== modified file 'libgearman/vector.hpp'
--- libgearman/vector.hpp	2013-05-07 09:50:42 +0000
+++ libgearman/vector.hpp	2013-07-06 00:44:27 +0000
@@ -104,6 +104,11 @@
     return string;
   }
 
+  const char* c_str() const
+  {
+    return string;
+  }
+
   const void* void_ptr() const
   {
     return (const void*)string;

=== modified file 'libgearman/worker.hpp'
--- libgearman/worker.hpp	2013-03-15 21:54:07 +0000
+++ libgearman/worker.hpp	2013-07-06 00:44:27 +0000
@@ -55,6 +55,8 @@
     {
       throw std::runtime_error("gearman_worker_create() failed");
     }
+
+    enable_ssl();
   }
 
   Worker(in_port_t arg)
@@ -66,6 +68,8 @@
       throw std::runtime_error("gearman_worker_create() failed");
     }
     gearman_worker_add_server(_worker, "localhost", arg);
+
+    enable_ssl();
   }
 
   gearman_worker_st* operator&() const
@@ -83,6 +87,14 @@
     gearman_worker_free(_worker);
   }
 
+  void enable_ssl()
+  { 
+    if (getenv("GEARMAND_CA_CERTIFICATE"))
+    {
+      gearman_worker_add_options(_worker, GEARMAN_WORKER_SSL);
+    }
+  }
+
 private:
   gearman_worker_st *_worker;
 

=== modified file 'libtest/client.cc'
--- libtest/client.cc	2013-06-05 21:59:31 +0000
+++ libtest/client.cc	2013-07-06 00:44:27 +0000
@@ -54,10 +54,6 @@
 # include <cyassl/ssl.h>
 #endif
 
-#define CA_CERT_PEM "/home/brian/cyassl/certs/ca-cert.pem"
-#define CERT_PEM "/home/brian/cyassl/certs/server-cert.pem"
-#define CERT_KEY_PEM "/home/brian/cyassl/certs/server-key.pem"
-
 namespace libtest {
 
 SimpleClient::SimpleClient(const std::string& hostname_, in_port_t port_) :
@@ -72,6 +68,11 @@
   _ctx_ssl(NULL),
   _ssl(NULL)
 {
+  if (is_ssl())
+  {
+    _is_ssl= true;
+  }
+
   init_ssl();
 }
 
@@ -87,19 +88,19 @@
       FATAL("CyaSSL_CTX_new error" == NULL);
     }
 
-    if (CyaSSL_CTX_load_verify_locations(_ctx_ssl, CA_CERT_PEM, 0) != SSL_SUCCESS)
+    if (CyaSSL_CTX_load_verify_locations(_ctx_ssl, YATL_CA_CERT_PEM, 0) != SSL_SUCCESS)
     {
-      FATAL("CyaSSL_CTX_load_verify_locations(%s) cannot obtain certificate", CA_CERT_PEM);
-    }
-
-    if (CyaSSL_CTX_use_certificate_file(_ctx_ssl, CERT_PEM, SSL_FILETYPE_PEM) != SSL_SUCCESS)
-    {   
-      FATAL("CyaSSL_CTX_use_certificate_file(%s) cannot obtain certificate", CERT_PEM);
-    }
-
-    if (CyaSSL_CTX_use_PrivateKey_file(_ctx_ssl, CERT_KEY_PEM, SSL_FILETYPE_PEM) != SSL_SUCCESS)
-    {   
-      FATAL("CyaSSL_CTX_use_PrivateKey_file(%s) cannot obtain certificate", CERT_KEY_PEM);
+      FATAL("CyaSSL_CTX_load_verify_locations(%s) cannot obtain certificate", YATL_CA_CERT_PEM);
+    }
+
+    if (CyaSSL_CTX_use_certificate_file(_ctx_ssl, YATL_CERT_PEM, SSL_FILETYPE_PEM) != SSL_SUCCESS)
+    {   
+      FATAL("CyaSSL_CTX_use_certificate_file(%s) cannot obtain certificate", YATL_CERT_PEM);
+    }
+
+    if (CyaSSL_CTX_use_PrivateKey_file(_ctx_ssl, YATL_CERT_KEY_PEM, SSL_FILETYPE_PEM) != SSL_SUCCESS)
+    {   
+      FATAL("CyaSSL_CTX_use_PrivateKey_file(%s) cannot obtain certificate", YATL_CERT_KEY_PEM);
     }
 #endif // defined(HAVE_CYASSL) && HAVE_CYASSL
   }

=== modified file 'libtest/gearmand.cc'
--- libtest/gearmand.cc	2013-06-05 21:59:31 +0000
+++ libtest/gearmand.cc	2013-07-06 00:44:27 +0000
@@ -150,6 +150,9 @@
   if (is_ssl())
   {
     add_option("--ssl");
+    add_option("--ssl-ca-file=" YATL_CA_CERT_PEM);
+    add_option("--ssl-certificate=" YATL_CERT_PEM);
+    add_option("--ssl-key=" YATL_CERT_KEY_PEM);
   }
 
   return true;

=== modified file 'libtest/include.am'
--- libtest/include.am	2013-07-03 03:54:06 +0000
+++ libtest/include.am	2013-07-06 00:44:27 +0000
@@ -94,6 +94,7 @@
 noinst_HEADERS+= libtest/server_container.h
 noinst_HEADERS+= libtest/signal.h
 noinst_HEADERS+= libtest/socket.hpp
+noinst_HEADERS+= libtest/ssl.h
 noinst_HEADERS+= libtest/stream.h
 noinst_HEADERS+= libtest/strerror.h
 noinst_HEADERS+= libtest/string.hpp

=== modified file 'libtest/is_local.cc'
--- libtest/is_local.cc	2013-06-05 21:59:31 +0000
+++ libtest/is_local.cc	2013-07-06 00:44:27 +0000
@@ -60,6 +60,23 @@
 void is_ssl(bool arg)
 {
   _is_ssl= arg;
+
+  if (_is_ssl)
+  {
+    setenv("GEARMAND_CA_CERTIFICATE", YATL_CA_CERT_PEM, false);
+    setenv("GEARMAND_SERVER_PEM", YATL_CERT_PEM, false);
+    setenv("GEARMAND_SERVER_KEY", YATL_CERT_KEY_PEM, false);
+    setenv("GEARMAND_CLIENT_PEM", YATL_CERT_PEM, false);
+    setenv("GEARMAND_CLIENT_KEY", YATL_CERT_KEY_PEM, false);
+  }
+  else
+  {
+    unsetenv("GEARMAND_CA_CERTIFICATE");
+    unsetenv("GEARMAND_SERVER_PEM");
+    unsetenv("GEARMAND_SERVER_KEY");
+    unsetenv("GEARMAND_CLIENT_PEM");
+    unsetenv("GEARMAND_CLIENT_KEY");
+  }
 }
 
 bool is_ssl()

=== added file 'libtest/ssl.h'
--- libtest/ssl.h	1970-01-01 00:00:00 +0000
+++ libtest/ssl.h	2013-07-06 00:44:27 +0000
@@ -0,0 +1,45 @@
+/*  vim:expandtab:shiftwidth=2:tabstop=2:smarttab:
+ *
+ *  Data Differential YATL (i.e. libtest)  library
+ *
+ *  Copyright (C) 2013 Data Differential, http://datadifferential.com/
+ *
+ *  Redistribution and use in source and binary forms, with or without
+ *  modification, are permitted provided that the following conditions are
+ *  met:
+ *
+ *      * Redistributions of source code must retain the above copyright
+ *  notice, this list of conditions and the following disclaimer.
+ *
+ *      * Redistributions in binary form must reproduce the above
+ *  copyright notice, this list of conditions and the following disclaimer
+ *  in the documentation and/or other materials provided with the
+ *  distribution.
+ *
+ *      * The names of its contributors may not be used to endorse or
+ *  promote products derived from this software without specific prior
+ *  written permission.
+ *
+ *  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ *  "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ *  LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ *  A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ *  OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ *  SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ *  LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ *  DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ *  THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ *  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ *  OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+/*
+  Location of ssl certs during testing.
+*/
+
+#pragma once
+
+#define YATL_CA_CERT_PEM "/home/brian/cyassl/certs/ca-cert.pem"
+#define YATL_CERT_PEM "/home/brian/cyassl/certs/server-cert.pem"
+#define YATL_CERT_KEY_PEM "/home/brian/cyassl/certs/server-key.pem"

=== modified file 'libtest/test.hpp'
--- libtest/test.hpp	2013-05-03 06:03:28 +0000
+++ libtest/test.hpp	2013-07-06 00:44:27 +0000
@@ -100,3 +100,5 @@
 #include <libtest/tmpfile.hpp>
 #include <libtest/client.hpp>
 #include <libtest/thread.hpp>
+#include <libtest/ssl.h>
+

=== modified file 'tests/libgearman-1.0/client_test.cc'
--- tests/libgearman-1.0/client_test.cc	2013-06-28 19:13:48 +0000
+++ tests/libgearman-1.0/client_test.cc	2013-07-06 00:44:27 +0000
@@ -459,7 +459,7 @@
 
   ASSERT_EQ(GEARMAN_SUCCESS, rc);
 
-  test_truth(job_result);
+  ASSERT_TRUE(job_result);
   ASSERT_EQ(gearman_size(value), result_length);
 
   test_memcmp(gearman_c_str(value), job_result, gearman_size(value));