ssl

Documentation

Overview

Package ssl provides the TLS layer for the SSL_GET health check.

Certificate verification is off by default

keepalived does not verify the server's certificate, so neither does this by default — the two have to agree about which backends a check accepts.

The port reproduces that, because SSL_GET is usually pointed at a backend on a trusted segment with a certificate that would not validate, and turning verification on by default would take those deployments down on upgrade. It is opt-in rather than absent: setting Verify enables it. The choice is the operator's, and making it requires knowing the choice exists — which is what this comment is for.

Index

• Variables
• func Dial(ctx context.Context, opts layer4.Options, c Config) (net.Conn, layer4.Result, error)
• type Config
  • func (c Config) TLSConfig() (*tls.Config, error)

Variables

var ErrEncryptedKey = errors.New("ssl: encrypted private keys are not supported")

ErrEncryptedKey is returned for a password-protected private key.

C decrypts it with an OpenSSL password callback (check_ssl.c:122-124). Go deliberately has no equivalent: `x509.DecryptPEMBlock` was deprecated and documented as insecure, because the PEM encryption scheme it implements uses an unauthenticated cipher with a weak KDF and cannot be used safely. There is no supported way to do this in the standard library, and re-implementing the broken scheme to preserve parity would be reproducing the weakness rather than the feature.

The remedy is to decrypt the key at rest and rely on file permissions, which is what the passphrase was doing anyway: it sits in the configuration file next to the key it protects.

Functions

func Dial

func Dial(ctx context.Context, opts layer4.Options, c Config) (net.Conn, layer4.Result, error)

Dial connects and completes the TLS handshake.

The plain connection is established through layer4 first so the same errno classification applies: a refused connection is a backend failure and a local file-descriptor limit is not. A handshake failure after a successful connect is a backend failure — the far end answered and then failed to be the service it claims to be.

Types

type Config

type Config struct {
	// CertFile is a client certificate chain in PEM form
	// (SSL_CTX_use_certificate_chain_file, check_ssl.c:114).
	CertFile string
	// KeyFile is the matching private key.
	KeyFile string
	// Password decrypts KeyFile. See ErrEncryptedKey.
	Password string
	// CAFile holds trust anchors. It has no effect unless Verify is set;
	// see the package comment.
	CAFile string

	// EnableSNI sends the server name in the handshake
	// (`enable_sni`, check_ssl.c:266-279).
	EnableSNI bool
	// ServerName is the name sent under SNI and checked when Verify is set.
	// It comes from the url's virtualhost, then the check's, then the
	// virtual server's — the order C resolves them in.
	ServerName string

	// Verify enables certificate verification. **keepalived does not do
	// this**; see the package comment. It is off by default so a ported
	// configuration behaves as it did, and available so an operator can
	// choose otherwise.
	Verify bool

	// TLSCompliant sends close_notify on shutdown. keepalived calls
	// SSL_set_quiet_shutdown(1) unless it is set (check_ssl.c:255-256),
	// which skips the alert. Go always sends it on Close, so this exists
	// for configuration fidelity rather than behaviour.
	TLSCompliant bool
}

Config mirrors keepalived's `ssl { }` block plus the per-check TLS options.

func (Config) TLSConfig

func (c Config) TLSConfig() (*tls.Config, error)

TLSConfig builds the client configuration.