key: extract error on read fail #9
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
3 tasks
DifferentialOrange
force-pushed
the
DifferentialOrange/flaky-bad-decrypt
branch
2 times, most recently
from
8f572b8 to
1e5db74
Compare
DifferentialOrange
changed the base branch from
v0.0.7-24-g0fadeb4-tarantool
to
master
DifferentialOrange
changed the title
Before this patch, read fail had generated a Go error to return it to a user, even though read errors (for example, caused by bad input or wrong password) were placed in error queue. Since goroutines are not binded to a thread and error queue is per thread, sometimes it had resulted in valid connections failing with error. This patch fixes the issue.
DifferentialOrange
force-pushed
the
DifferentialOrange/flaky-bad-decrypt
branch
from
1e5db74 to
bfc58d2
Compare
|
It seems that Windows tests are flaky and I don't see any reasons that my updates are the reason. |
oleg-jukovec
reviewed
Aug 1, 2023
Comment on lines
+306
to
311
| runtime.LockOSThread() | ||
| defer runtime.UnlockOSThread() | ||
| key := C.PEM_read_bio_PrivateKey(bio, nil, nil, nil) | ||
| if key == nil { | ||
| return nil, errors.New("failed reading private key") | ||
| return nil, fmt.Errorf("failed reading private key: %w", errorFromErrorQueue()) | ||
| } |
There was a problem hiding this comment.
We could extract it into a private function. Up to you.
oleg-jukovec
approved these changes
Aug 1, 2023
0x501D
approved these changes
Aug 1, 2023
DifferentialOrange
added a commit
to tarantool/go-tarantool
that referenced
this pull request
Aug 1, 2023
Support `ssl_password` and `ssl_password_file` options in SslOpts. Tarantool EE supports SSL passwords and password files since 2.11.0 [1]. Since it is possible to use corresponding non-encrypted key, cert and CA on server, tests works fine even for Tarantool EE 2.10.0. Same as in Tarantool, we try `SslOpts.Password`, then each line in `SslOpts.PasswordFile`. If all of the above fail, we re-raise errors. If the key is encrypted and password is not provided, `openssl.LoadPrivateKeyFromPEM(keyBytes)` asks to enter PEM pass phrase interactively. On the other hand, `openssl.LoadPrivateKeyFromPEMWithPassword(keyBytes, password)` works fine for non-encrypted key with any password, including empty string. If the key is encrypted, we fast fail with password error instead of requesting the pass phrase interactively. The patch also bumps go-openssl since latest patch fixes flaky tests [2]. The patch is based on a similar patch for tarantool-python [3]. 1. tarantool/tarantool-ee#22 2. tarantool/go-openssl#9 3. tarantool/tarantool-python#274
DifferentialOrange
added a commit
to tarantool/go-tarantool
that referenced
this pull request
Aug 1, 2023
Support `ssl_password` and `ssl_password_file` options in SslOpts. Tarantool EE supports SSL passwords and password files since 2.11.0 [1]. Since it is possible to use corresponding non-encrypted key, cert and CA on server, tests works fine even for Tarantool EE 2.10.0. Same as in Tarantool, we try `SslOpts.Password`, then each line in `SslOpts.PasswordFile`. If all of the above fail, we re-raise errors. If the key is encrypted and password is not provided, `openssl.LoadPrivateKeyFromPEM(keyBytes)` asks to enter PEM pass phrase interactively. On the other hand, `openssl.LoadPrivateKeyFromPEMWithPassword(keyBytes, password)` works fine for non-encrypted key with any password, including empty string. If the key is encrypted, we fast fail with password error instead of requesting the pass phrase interactively. The patch also bumps go-openssl since latest patch fixes flaky tests [2]. The patch is based on a similar patch for tarantool-python [3]. 1. tarantool/tarantool-ee#22 2. tarantool/go-openssl#9 3. tarantool/tarantool-python#274
DifferentialOrange
added a commit
to tarantool/go-tarantool
that referenced
this pull request
Aug 1, 2023
Support `ssl_password` and `ssl_password_file` options in SslOpts. Tarantool EE supports SSL passwords and password files since 2.11.0 [1]. Since it is possible to use corresponding non-encrypted key, cert and CA on server, tests works fine even for Tarantool EE 2.10.0. Same as in Tarantool, we try `SslOpts.Password`, then each line in `SslOpts.PasswordFile`. If all of the above fail, we re-raise errors. If the key is encrypted and password is not provided, `openssl.LoadPrivateKeyFromPEM(keyBytes)` asks to enter PEM pass phrase interactively. On the other hand, `openssl.LoadPrivateKeyFromPEMWithPassword(keyBytes, password)` works fine for non-encrypted key with any password, including empty string. If the key is encrypted, we fast fail with password error instead of requesting the pass phrase interactively. The patch also bumps go-openssl since latest patch fixes flaky tests [2]. The patch is based on a similar patch for tarantool-python [3]. 1. tarantool/tarantool-ee#22 2. tarantool/go-openssl#9 3. tarantool/tarantool-python#274
DifferentialOrange
added a commit
to tarantool/go-tarantool
that referenced
this pull request
Aug 3, 2023
Support `ssl_password` and `ssl_password_file` options in SslOpts. Tarantool EE supports SSL passwords and password files since 2.11.0 [1]. Since it is possible to use corresponding non-encrypted key, cert and CA on server, tests works fine even for Tarantool EE 2.10.0. Same as in Tarantool, we try `SslOpts.Password`, then each line in `SslOpts.PasswordFile`. If all of the above fail, we re-raise errors. If the key is encrypted and password is not provided, `openssl.LoadPrivateKeyFromPEM(keyBytes)` asks to enter PEM pass phrase interactively. On the other hand, `openssl.LoadPrivateKeyFromPEMWithPassword(keyBytes, password)` works fine for non-encrypted key with any password, including empty string. If the key is encrypted, we fast fail with password error instead of requesting the pass phrase interactively. The patch also bumps go-openssl since latest patch fixes flaky tests [2]. The patch is based on a similar patch for tarantool-python [3]. 1. tarantool/tarantool-ee#22 2. tarantool/go-openssl#9 3. tarantool/tarantool-python#274
DifferentialOrange
added a commit
to tarantool/go-tarantool
that referenced
this pull request
Aug 3, 2023
Support `ssl_password` and `ssl_password_file` options in SslOpts. Tarantool EE supports SSL passwords and password files since 2.11.0 [1]. Since it is possible to use corresponding non-encrypted key, cert and CA on server, tests works fine even for Tarantool EE 2.10.0. Same as in Tarantool, we try `SslOpts.Password`, then each line in `SslOpts.PasswordFile`. If all of the above fail, we re-raise errors. If the key is encrypted and password is not provided, `openssl.LoadPrivateKeyFromPEM(keyBytes)` asks to enter PEM pass phrase interactively. On the other hand, `openssl.LoadPrivateKeyFromPEMWithPassword(keyBytes, password)` works fine for non-encrypted key with any password, including empty string. If the key is encrypted, we fast fail with password error instead of requesting the pass phrase interactively. The patch also bumps go-openssl since latest patch fixes flaky tests [2]. The patch is based on a similar patch for tarantool-python [3]. 1. tarantool/tarantool-ee#22 2. tarantool/go-openssl#9 3. tarantool/tarantool-python#274
DifferentialOrange
added a commit
to tarantool/go-tarantool
that referenced
this pull request
Aug 3, 2023
Support `ssl_password` and `ssl_password_file` options in SslOpts. Tarantool EE supports SSL passwords and password files since 2.11.0 [1]. Since it is possible to use corresponding non-encrypted key, cert and CA on server, tests works fine even for Tarantool EE 2.10.0. Same as in Tarantool, we try `SslOpts.Password`, then each line in `SslOpts.PasswordFile`. If all of the above fail, we re-raise errors. If the key is encrypted and password is not provided, `openssl.LoadPrivateKeyFromPEM(keyBytes)` asks to enter PEM pass phrase interactively. On the other hand, `openssl.LoadPrivateKeyFromPEMWithPassword(keyBytes, password)` works fine for non-encrypted key with any password, including empty string. If the key is encrypted, we fast fail with password error instead of requesting the pass phrase interactively. The patch also bumps go-openssl since latest patch fixes flaky tests [2]. The patch is based on a similar patch for tarantool-python [3]. 1. tarantool/tarantool-ee#22 2. tarantool/go-openssl#9 3. tarantool/tarantool-python#274
DifferentialOrange
added a commit
to tarantool/go-tarantool
that referenced
this pull request
Aug 3, 2023
Support `ssl_password` and `ssl_password_file` options in SslOpts. Tarantool EE supports SSL passwords and password files since 2.11.0 [1]. Since it is possible to use corresponding non-encrypted key, cert and CA on server, tests works fine even for Tarantool EE 2.10.0. Same as in Tarantool, we try `SslOpts.Password`, then each line in `SslOpts.PasswordFile`. If all of the above fail, we re-raise errors. If the key is encrypted and password is not provided, `openssl.LoadPrivateKeyFromPEM(keyBytes)` asks to enter PEM pass phrase interactively. On the other hand, `openssl.LoadPrivateKeyFromPEMWithPassword(keyBytes, password)` works fine for non-encrypted key with any password, including empty string. If the key is encrypted, we fast fail with password error instead of requesting the pass phrase interactively. The patch also bumps go-openssl since latest patch fixes flaky tests [2]. The patch is based on a similar patch for tarantool-python [3]. 1. tarantool/tarantool-ee#22 2. tarantool/go-openssl#9 3. tarantool/tarantool-python#274
oleg-jukovec
pushed a commit
to tarantool/go-tarantool
that referenced
this pull request
Aug 3, 2023
Support `ssl_password` and `ssl_password_file` options in SslOpts. Tarantool EE supports SSL passwords and password files since 2.11.0 [1]. Since it is possible to use corresponding non-encrypted key, cert and CA on server, tests works fine even for Tarantool EE 2.10.0. Same as in Tarantool, we try `SslOpts.Password`, then each line in `SslOpts.PasswordFile`. If all of the above fail, we re-raise errors. If the key is encrypted and password is not provided, `openssl.LoadPrivateKeyFromPEM(keyBytes)` asks to enter PEM pass phrase interactively. On the other hand, `openssl.LoadPrivateKeyFromPEMWithPassword(keyBytes, password)` works fine for non-encrypted key with any password, including empty string. If the key is encrypted, we fast fail with password error instead of requesting the pass phrase interactively. The patch also bumps go-openssl since latest patch fixes flaky tests [2]. The patch is based on a similar patch for tarantool-python [3]. 1. tarantool/tarantool-ee#22 2. tarantool/go-openssl#9 3. tarantool/tarantool-python#274
oleg-jukovec
added a commit
that referenced
this pull request
Feb 8, 2024
Overview
The first release with a number of fixes. Since `libp2p/openssl`
is not supported any more we need to support our version for usage
in the Golang connector `tarantool/go-tarantool`.
New features
DialContext function (#10).
Bugfixes
Build by Golang 1.13 (#6).
Build with OpenSSL < 1.1.1 (#7).
Build on macOS as a static library (#8).
Build on macOS with Apple M1 (#8).
Random errors in the code caused by an invalid OpenSSL error
handling in LoadPrivateKeyFromPEM,
LoadPrivateKeyFromPEMWithPassword,
LoadPrivateKeyFromDER and LoadPublicKeyFromPEM (#9).
Merged
oleg-jukovec
added a commit
that referenced
this pull request
Feb 8, 2024
Overview
The first release with a number of fixes. Since `libp2p/openssl`
is not supported any more we need to support our version for usage
in the Golang connector `tarantool/go-tarantool`.
See releases of `libp2p/openssl`[1] for previous changes history.
New features
DialContext function (#10).
Bugfixes
Build by Golang 1.13 (#6).
Build with OpenSSL < 1.1.1 (#7).
Build on macOS as a static library (#8).
Build on macOS with Apple M1 (#8).
Random errors in the code caused by an invalid OpenSSL error
handling in LoadPrivateKeyFromPEM,
LoadPrivateKeyFromPEMWithPassword,
LoadPrivateKeyFromDER and LoadPublicKeyFromPEM (#9).
1. https://github.com/libp2p/go-openssl/releases
oleg-jukovec
added a commit
that referenced
this pull request
Feb 8, 2024
Overview
The first release with a number of fixes. Since `libp2p/openssl`
is not supported any more we need to support our version for usage
in the Golang connector `tarantool/go-tarantool`.
See releases of `libp2p/openssl`[1] for previous changes history.
New features
DialContext function (#10).
Bugfixes
Build by Golang 1.13 (#6).
Build with OpenSSL < 1.1.1 (#7).
Build on macOS as a static library (#8).
Build on macOS with Apple M1 (#8).
Random errors in the code caused by an invalid OpenSSL error
handling in LoadPrivateKeyFromPEM,
LoadPrivateKeyFromPEMWithPassword,
LoadPrivateKeyFromDER and LoadPublicKeyFromPEM (#9).
1. https://github.com/libp2p/go-openssl/releases
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Before this patch, read fail had generated a Go error to return it to a user, even though read errors (for example, caused by bad input or wrong password) were placed in error queue. Since goroutines are not binded to a thread and error queue is per thread, sometimes it had resulted in valid connections failing with error. This patch fixes the issue.