Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fail hard if SSL certs or keys cannot be read by user #2847

Merged
merged 2 commits into from
Apr 2, 2022

Conversation

stanhu
Copy link
Contributor

@stanhu stanhu commented Mar 26, 2022

Description

Previously if an SSL cert or key could not be read, Puma would bind to
the configured SSL port but not accept any connections. The only
indication that something went awry is an obscure log message:

 #<Puma::MiniSSL::SSLError: OpenSSL error: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher - 193>

We now fail hard with an exception if this happens to make it clear
that the permissions need to be fixed.

Relates to #1339

Your checklist for this pull request

  • I have reviewed the guidelines for contributing to this repository.
  • I have added (or updated) appropriate tests if this PR fixes a bug or adds a feature.
  • My pull request is 100 lines added/removed or less so that it can be easily reviewed.
  • If this PR doesn't need tests (docs change), I added [ci skip] to the title of the PR.
  • If this closes any issues, I have added "Closes #issue" to the PR description or my commit messages.
  • I have updated the documentation accordingly.
  • All new and existing tests passed, including Rubocop.

Previously if an SSL cert or key could not be read, Puma would bind to
the configured SSL port but not accept any connections. The only
indication that something went awry is an obscure log message:

```
 #<Puma::MiniSSL::SSLError: OpenSSL error: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher - 193>
```

We now fail hard with an exception if this happens to make it clear
that the permissions need to be fixed.

Relates to puma#1339
@MSP-Greg
Copy link
Member

MSP-Greg commented Mar 26, 2022

@stanhu

Thanks for the PR, good catch/idea. Maybe add a method for file checking, something like:

      def check_file(file, desc)
        raise ArgumentError, "#{desc} file '#{file}' does not exist" unless File.exist? file
        raise ArgumentError, "#{desc} file '#{file}' is not readable" unless File.readable? file
      end

Also, perform the same update to the JRuby keystore file?

See MSP-Greg@a254765, I can push the commit to your branch.

@stanhu
Copy link
Contributor Author

stanhu commented Mar 26, 2022

Works for me!

@nateberkopec nateberkopec merged commit f4fb51d into puma:master Apr 2, 2022
MSP-Greg added a commit to MSP-Greg/puma that referenced this pull request Apr 3, 2022
* Fail hard if SSL certs or keys cannot be read by user

Previously if an SSL cert or key could not be read, Puma would bind to
the configured SSL port but not accept any connections. The only
indication that something went awry is an obscure log message:

```
 #<Puma::MiniSSL::SSLError: OpenSSL error: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher - 193>
```

We now fail hard with an exception if this happens to make it clear
that the permissions need to be fixed.

Relates to puma#1339

* minissl.rb - add check_file method

Co-authored-by: MSP-Greg <Greg.mpls@gmail.com>
@MSP-Greg MSP-Greg mentioned this pull request Apr 4, 2022
7 tasks
nateberkopec pushed a commit that referenced this pull request Aug 22, 2022
* Fail hard if SSL certs or keys cannot be read by user

Previously if an SSL cert or key could not be read, Puma would bind to
the configured SSL port but not accept any connections. The only
indication that something went awry is an obscure log message:

```
 #<Puma::MiniSSL::SSLError: OpenSSL error: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher - 193>
```

We now fail hard with an exception if this happens to make it clear
that the permissions need to be fixed.

Relates to #1339

* minissl.rb - add check_file method

Co-authored-by: MSP-Greg <Greg.mpls@gmail.com>
JuanitoFatas pushed a commit to JuanitoFatas/puma that referenced this pull request Sep 9, 2022
* Fail hard if SSL certs or keys cannot be read by user

Previously if an SSL cert or key could not be read, Puma would bind to
the configured SSL port but not accept any connections. The only
indication that something went awry is an obscure log message:

```
 #<Puma::MiniSSL::SSLError: OpenSSL error: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher - 193>
```

We now fail hard with an exception if this happens to make it clear
that the permissions need to be fixed.

Relates to puma#1339

* minissl.rb - add check_file method

Co-authored-by: MSP-Greg <Greg.mpls@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants