tarantool / go-tarantool / 5750393984

75%

push

github

api: support SSL private key file decryption

Support `ssl_password` and `ssl_password_file` options in SslOpts.
Tarantool EE supports SSL passwords and password files since 2.11.0 [1].
Since it is possible to use corresponding non-encrypted key, cert and CA
on server, tests works fine even for Tarantool EE 2.10.0.

Same as in Tarantool, we try `SslOpts.Password`, then each line in
`SslOpts.PasswordFile`. If all of the above fail, we re-raise errors.

If the key is encrypted and password is not provided,
`openssl.LoadPrivateKeyFromPEM(keyBytes)` asks to enter PEM pass phrase
interactively. On the other hand,
`openssl.LoadPrivateKeyFromPEMWithPassword(keyBytes, password)` works
fine for non-encrypted key with any password, including empty string.
If the key is encrypted, we fast fail with password error instead of
requesting the pass phrase interactively.

The patch also bumps go-openssl since latest patch fixes flaky
tests [2].

The patch is based on a similar patch for tarantool-python [3].

1. https://github.com/tarantool/tarantool-ee/issues/22
2. https://github.com/tarantool/go-openssl/pull/9
3. https://github.com/tarantool/tarantool-python/pull/274

28 of 28 new or added lines in 1 file covered. (100.0%)

5322 of 6702 relevant lines covered (79.41%)

7900.1 hits per line