--- parser3/src/classes/redis.C	2026/10/07 12:07:48	1.4
+++ parser3/src/classes/redis.C	2026/10/09 00:30:40	1.6
@@ -14,13 +14,13 @@
 #include "pa_vbool.h"
 #include "pa_vfile.h"
 
-volatile const char * IDENT_REDIS_C="$Id: redis.C,v 1.4 2026/10/07 12:07:48 moko Exp $" IDENT_PA_VREDIS_H;
+volatile const char * IDENT_REDIS_C="$Id: redis.C,v 1.6 2026/10/09 00:30:40 moko Exp $" IDENT_PA_VREDIS_H;
 
 // defines
 
 #define DEFAULT_TIMEOUT 2 // seconds
-// ^r.file-get[key], ^r.file-call[GET;key]: the strings of the reply are files
-#define FILE_PREFIX "file-"
+// ^r.f-get[key], ^r.f-call[GET;key]: the strings of the reply are files
+#define FILE_PREFIX "f-"
 
 class MRedis: public Methoded {
 public: // VStateless_class
@@ -46,6 +46,13 @@ static void _open(Request& r, MethodPara
 	int db=0;
 	int protocol=3;
 	int auto_reconnect=0;
+#ifdef WITH_REDIS_SSL
+	bool tls_specified=false;
+	const char* tls_ca=0;
+	const char* tls_cert=0;
+	const char* tls_key=0;
+	bool tls_verify=true;
+#endif
 
 	if(params.count()>0)
 		if(HashStringValue* options=params.as_hash(0)) {
@@ -74,6 +81,27 @@ static void _open(Request& r, MethodPara
 						throw Exception(PARSER_RUNTIME, 0, "protocol must be 2 or 3");
 				} else if(key=="auto_reconnect") {
 					auto_reconnect=r.process(*value).as_int();
+				} else if(key=="tls") {
+#ifdef WITH_REDIS_SSL
+					tls_specified=true;
+					if(HashStringValue* tls_options=value->get_hash())
+						for(HashStringValue::Iterator t(*tls_options); t; t.next()) {
+							String::Body tkey=t.key();
+							Value* tvalue=t.value();
+							if(tkey=="ca") {
+								tls_ca=tvalue->as_string().cstr();
+							} else if(tkey=="cert") {
+								tls_cert=tvalue->as_string().cstr();
+							} else if(tkey=="key") {
+								tls_key=tvalue->as_string().cstr();
+							} else if(tkey=="verify") {
+								tls_verify=r.process(*tvalue).as_bool();
+							} else
+								throw Exception(PARSER_RUNTIME, 0, CALLED_WITH_INVALID_OPTION);
+						}
+#else
+					throw Exception("redis", 0, "compiled without redis SSL support");
+#endif
 				} else
 					throw Exception(PARSER_RUNTIME, 0, CALLED_WITH_INVALID_OPTION);
 			}
@@ -98,21 +126,8 @@ static void _open(Request& r, MethodPara
 	}
 
 	// ^r.open[] of an opened object: close the old connection first
-	if(self.fcontext) {
-		redisFree(self.fcontext);
-		self.fcontext=0;
-	}
-
-	redisContext* context=redisConnectWithOptions(&options);
-	if(!context)
-		throw Exception("redis", 0, "connect failed: out of memory");
-	if(context->err) {
-		const char* error=pa_strdup(context->errstr);
-		redisFree(context);
-		throw Exception("redis", 0, "connect failed: %s", error);
-	}
+	self.release();
 
-	self.fcontext=context;
 	self.fuser=user;
 	self.fpassword=password;
 	self.fdb=db;
@@ -120,21 +135,43 @@ static void _open(Request& r, MethodPara
 	self.fauto_reconnect=auto_reconnect;
 
 	try {
+#ifdef WITH_REDIS_SSL
+		if(tls_specified) {
+			static bool ssl_initialized=false; // OpenSSL before 1.1 needs it once
+			if(!ssl_initialized) {
+				redisInitOpenSSL();
+				ssl_initialized=true;
+			}
+
+			redisSSLOptions ssl_options;
+			memset(&ssl_options, 0, sizeof(ssl_options));
+			ssl_options.cacert_filename=tls_ca;
+			ssl_options.cert_filename=tls_cert;
+			ssl_options.private_key_filename=tls_key;
+			ssl_options.server_name=host;
+			// as amqp: the server certificate is checked only against the given ca
+			ssl_options.verify_mode=tls_verify && tls_ca ? REDIS_SSL_VERIFY_PEER : REDIS_SSL_VERIFY_NONE;
+
+			redisSSLContextError error=REDIS_SSL_CTX_NONE;
+			if(!(self.fssl_context=redisCreateSSLContextWithOptions(&ssl_options, &error)))
+				throw Exception("redis", 0, "SSL context failed: %s", redisSSLContextGetError(error));
+		}
+#endif
+
+		if(!(self.fcontext=redisConnectWithOptions(&options)))
+			throw Exception("redis", 0, "connect failed: out of memory");
+		if(self.fcontext->err)
+			throw Exception("redis", 0, "connect failed: %s", self.fcontext->errstr);
+
 		self.handshake();
 	} catch(...) {
-		redisFree(context);
-		self.fcontext=0;
+		self.release();
 		throw;
 	}
 }
 
 static void _release(Request& r, MethodParams&) {
-	VRedis& self=GET_SELF(r, VRedis);
-
-	if(self.fcontext) {
-		redisFree(self.fcontext);
-		self.fcontext=0;
-	}
+	GET_SELF(r, VRedis).release();
 }
 
 static Value* reply_value(redisReply& reply, bool as_file, const String& command) {
@@ -236,12 +273,10 @@ static void redis_command(Request& r, Me
 	r.write(*reply_value(*reply, as_file, command));
 }
 
-// ^r.call[command;arguments...]
 static void _call(Request& r, MethodParams& params) {
 	redis_command(r, params, params.as_string(0, "command must be string"), 1, false);
 }
 
-// ^r.file-call[command;arguments...]: the strings of the reply are files
 static void _file_call(Request& r, MethodParams& params) {
 	redis_command(r, params, params.as_string(0, "command must be string"), 1, true);
 }
@@ -267,14 +302,15 @@ static void _open(Request&, MethodParams
 #endif // WITH_REDIS
 
 MRedis::MRedis(): Methoded("redis") {
-	// ^redis::open[ $.host[localhost] $.port(6379) $.unix_socket[path] $.user[] $.password[] $.db(0) $.timeout(seconds, 0 is none) $.protocol(3) $.auto_reconnect(seconds) ]
+	// ^redis::open[ $.host[localhost] $.port(6379) $.unix_socket[path] $.user[] $.password[] $.db(0) $.timeout(seconds, 0 is none) $.protocol(3) $.auto_reconnect(seconds)
+	//	$.tls[ $.ca[path] $.cert[path] $.key[path] $.verify(true) ] ]
 	add_native_method("open", Method::CT_DYNAMIC, _open, 0, 1);
 
 #ifdef WITH_REDIS
 	// ^r.call[command;arguments...]
 	add_native_method("call", Method::CT_DYNAMIC, _call, 1, MAX_REDIS_COMMAND_PARAMS);
 
-	// ^r.file-call[command;arguments...]
+	// ^r.f-call[command;arguments...]
 	add_native_method(FILE_PREFIX "call", Method::CT_DYNAMIC, _file_call, 1, MAX_REDIS_COMMAND_PARAMS);
 
 	// ^r.release[]