Lookup openssl certs at tarantool startup
The static build isn't as portable as it should be. In fact, the OPENSSLDIR is configured at build time, but in runtime, it may (and do) differ: ``` $ strace tarantool -e 'require("http.client").get("https://...")' ... openat(AT_FDCWD, "/__w/sdk/sdk/build/tarantool/static-build/" "openssl-prefix/ssl/cert.pem", O_RDONLY) = -1 ENOENT (No such file or directory) ... stat("/__w/sdk/sdk/build/tarantool/static-build/" "openssl-prefix/ssl/certs/...", ...) = -1 ENOENT (No such file or directory) ... ``` As a result, statically build tarantool can't open some https links with an error: ``` tarantool> http_client = require('http.client').new({max_connections = 5}) tarantool> http_client:get('https://..../', {verbose = true}) * Trying X.Y.Z.W:443... * TCP_NODELAY set * Connected to .... (X.Y.Z.W) port 443 (#0) * ALPN, offering http/1.1 * SSL certificate problem: self signed certificate in certificate chain * Closing connection 0 --- - status: 495 reason: SSL peer certificate or SSH remote key was not OK ... ``` Also this error may occur at dynamically build tarantool in case of linkage tarantool binary with incorrectly configured openssl. In this patch, we adopt the approach from the golang ecosystem [1-3]. At startup, tarantool scans several popular locations and uses it for `SSL_CERT_DIR` and/or `SSL_CERT_FILE` setting. See also [4,5] - it's fun. [1] https://serverfault.com/a/722646 [2] https://golang.org/src/crypto/x509/root_unix.go [3] https://golang.org/src/crypto/x509/root_linux.go [4] https://github.com/edenhill/librdkafka/blob/cb69d2a8486344252e0fcaa1f959c4ab2d8afff3/src/rdkafka_ssl.c#L845 [5] https://www.happyassassin.net/posts/2015/01/12/a-note-about-ssltls-trusted-certificate-stores-and-platforms/ Close #5615 Co-authored-by:Yaroslav Dynnikov <yaroslav.dynnikov@gmail.com>
Showing
- src/CMakeLists.txt 1 addition, 0 deletionssrc/CMakeLists.txt
- src/main.cc 7 additions, 0 deletionssrc/main.cc
- src/ssl_cert_paths_discover.c 159 additions, 0 deletionssrc/ssl_cert_paths_discover.c
- src/ssl_cert_paths_discover.h 54 additions, 0 deletionssrc/ssl_cert_paths_discover.h
- test/app-tap/ssl-cert-paths-discover.test.lua 181 additions, 0 deletionstest/app-tap/ssl-cert-paths-discover.test.lua
Loading
Please register or sign in to comment