api: support SSL private key file decryption #319
Merged
+304
−36
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
DifferentialOrange
force-pushed
the
DifferentialOrange/ssl-key-decryption
branch
from
e915bb8 to
1c49429
Compare
DifferentialOrange
force-pushed
the
DifferentialOrange/ssl-key-decryption
branch
4 times, most recently
from
2f20c34 to
7023bbc
Compare
|
I'm inspecting flaky tests right now, follow tarantool/go-openssl#9 |
DifferentialOrange
force-pushed
the
DifferentialOrange/ssl-key-decryption
branch
2 times, most recently
from
3ab5960 to
1a2250e
Compare
Fix was introduced, everything should be fine now. (Last fail was due to missing deps bump.) |
DifferentialOrange
force-pushed
the
DifferentialOrange/ssl-key-decryption
branch
from
1a2250e to
6e7d9a7
Compare
oleg-jukovec
reviewed
Aug 1, 2023
Run with release 2.11.0 SDK instead of a dev one. 1. tarantool/tt@12bf404
"empty" and "key_crt_client" test cases do not provide SSL files to a server started with SSL transport. In these cases server fails to start, and tests ensures that server fails. It doesn't related to go-tarantool connector testing in any way -- it's the test of a tarantool binary. Since testing core tarantool is not the part of go-tarantool project, this patch removes these cases. The main motivation of this patch is the next commit in the patchset, which separates check for server start and client success of fail.
DifferentialOrange
force-pushed
the
DifferentialOrange/ssl-key-decryption
branch
from
6e7d9a7 to
0d06b1c
Compare
oleg-jukovec
reviewed
Aug 1, 2023
oleg-jukovec
reviewed
Aug 1, 2023
oleg-jukovec
reviewed
Aug 1, 2023
oleg-jukovec
reviewed
Aug 1, 2023
oleg-jukovec
reviewed
Aug 1, 2023
DerekBum
reviewed
Aug 2, 2023
Current SSL tests are as follows. We start a Tarantool server with default helpers. "ok" tests are successful if everything had started, "fail" tests are successful if ping check had failed (aka we failed to connect). This is a dangerous approach, since "server had failed to start" here is indistinguishable from "client cannot connect". Moreover, because of it each tnt_fail test runs for 5 seconds (10 retry attempts * 500 ms retry wait), which is frustrating. After this patch, there is a separate check for a server start and for a client success or fail.
DifferentialOrange
force-pushed
the
DifferentialOrange/ssl-key-decryption
branch
2 times, most recently
from
037bd6f to
b8d9740
Compare
|
I've also added a couple of test cases with non-existing file |
DifferentialOrange
force-pushed
the
DifferentialOrange/ssl-key-decryption
branch
from
b8d9740 to
0c7939c
Compare
oleg-jukovec
reviewed
Aug 3, 2023
Support `ssl_password` and `ssl_password_file` options in SslOpts. Tarantool EE supports SSL passwords and password files since 2.11.0 [1]. Since it is possible to use corresponding non-encrypted key, cert and CA on server, tests works fine even for Tarantool EE 2.10.0. Same as in Tarantool, we try `SslOpts.Password`, then each line in `SslOpts.PasswordFile`. If all of the above fail, we re-raise errors. If the key is encrypted and password is not provided, `openssl.LoadPrivateKeyFromPEM(keyBytes)` asks to enter PEM pass phrase interactively. On the other hand, `openssl.LoadPrivateKeyFromPEMWithPassword(keyBytes, password)` works fine for non-encrypted key with any password, including empty string. If the key is encrypted, we fast fail with password error instead of requesting the pass phrase interactively. The patch also bumps go-openssl since latest patch fixes flaky tests [2]. The patch is based on a similar patch for tarantool-python [3]. 1. tarantool/tarantool-ee#22 2. tarantool/go-openssl#9 3. tarantool/tarantool-python#274
DifferentialOrange
force-pushed
the
DifferentialOrange/ssl-key-decryption
branch
from
0c7939c to
afa063b
Compare
oleg-jukovec
approved these changes
Aug 3, 2023
DerekBum
approved these changes
Aug 3, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
See commit messages for detailed info.
I didn't forget about (remove if it is not applicable):