tarantool / go-tarantool / 5727326968

79%

master: 75%

push

github

api: support SSL private key file decryption

Support `ssl_password` and `ssl_password_file` options in SslOpts.
Tarantool EE supports SSL passwords and password files since 2.11.0 [1].
Since it is possible to use corresponding non-encrypted key, cert and CA
on server, tests works fine even for Tarantool EE 2.10.0.

Same as in Tarantool, we try `SslOpts.Password`, then each line in
`SslOpts.PasswordFile`. If all of the above fail, we re-raise errors.

If the key is encrypted and password is not provided,
`openssl.LoadPrivateKeyFromPEM(keyBytes)` asks to enter PEM pass phrase
interactively. On the other hand,
`openssl.LoadPrivateKeyFromPEMWithPassword(keyBytes, password)` works
fine for non-encrypted key with any password, including empty string.
If the key is encrypted, we fast fail with password error instead of
requesting the pass phrase interactively.

The patch also bumps go-openssl since latest patch fixes flaky
tests [2].

The patch is based on a similar patch for tarantool-python [3].

1. https://github.com/tarantool/tarantool-ee/issues/22
2. https://github.com/tarantool/go-openssl/pull/9
3. https://github.com/tarantool/tarantool-python/pull/274

55 of 55 new or added lines in 1 file covered. (100.0%)

5338 of 6730 relevant lines covered (79.32%)

7955.44 hits per line