Skip to content
Snippets Groups Projects
Commit a450713f authored by HustonMmmavr's avatar HustonMmmavr Committed by Kirill Yukhin
Browse files

Lookup openssl certs at tarantool startup

The static build isn't as portable as it should be. In fact, the
OPENSSLDIR is configured at build time, but in runtime, it may (and do)
differ:

```
$ strace tarantool -e 'require("http.client").get("https://...")'
...
openat(AT_FDCWD, "/__w/sdk/sdk/build/tarantool/static-build/"
                 "openssl-prefix/ssl/cert.pem", O_RDONLY) =
                 -1 ENOENT (No such file or directory)
...
stat("/__w/sdk/sdk/build/tarantool/static-build/"
     "openssl-prefix/ssl/certs/...", ...) =
     -1 ENOENT (No such file or directory)
...
```

As a result, statically build tarantool can't open some https links with
an error:

```
tarantool> http_client = require('http.client').new({max_connections = 5})
tarantool> http_client:get('https://..../', {verbose = true})
*   Trying X.Y.Z.W:443...
* TCP_NODELAY set
* Connected to .... (X.Y.Z.W) port 443 (#0)
* ALPN, offering http/1.1
* SSL certificate problem: self signed certificate in certificate chain
* Closing connection 0
---
- status: 495
  reason: SSL peer certificate or SSH remote key was not OK
...
```

Also this error may occur at dynamically build tarantool in case of
linkage tarantool binary with incorrectly configured openssl.

In this patch, we adopt the approach from the golang ecosystem [1-3].
At startup, tarantool scans several popular locations and uses it for
`SSL_CERT_DIR` and/or `SSL_CERT_FILE` setting. See also [4,5] - it's
fun.

[1] https://serverfault.com/a/722646
[2] https://golang.org/src/crypto/x509/root_unix.go
[3] https://golang.org/src/crypto/x509/root_linux.go
[4] https://github.com/edenhill/librdkafka/blob/cb69d2a8486344252e0fcaa1f959c4ab2d8afff3/src/rdkafka_ssl.c#L845
[5] https://www.happyassassin.net/posts/2015/01/12/a-note-about-ssltls-trusted-certificate-stores-and-platforms/



Close #5615

Co-authored-by: default avatarYaroslav Dynnikov <yaroslav.dynnikov@gmail.com>
parent 3fe840b0
No related branches found
No related tags found
No related merge requests found
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment