apple / apple/foundationdb

Setting FDBNetworkOption::FDB_NET_OPTION_TLS_KEY_BYTES has no effect

Open
#11,202 1 comment 6 reactions 0 assignees View on GitHub
Dominant language
C++
Stars
16.7k
Forks
1.6k
Avg merge
1d 20h
Merged PRs (30d)
126

Description

Hi!

For some reason setting `FDBNetworkOption::FDB_NET_OPTION_TLS_KEY_BYTES` and similar `TLS_CERT_BYTES`, `TLS_CA_BYTES` seems like does not have any effect. We use `fdb_network_set_option()` for this matter.

After setting everything we receive transaction timeouts and the following in client logs:
```

```
On the other hand setting environment variables `FDB_TLS_CERTIFICATE_FILE`, `FDB_TLS_KEY_FILE`, `FDB_TLS_CA_FILE` with the paths to the files with same content does the trick and everything works.

We've also tried setting `FDBNetworkOption::FDB_NET_OPTION_TLS_KEY_PATH` and other `_PATH` options with no effect as well.

Environment:
- FDB 7.1.51
- Client in Docker container `Linux c31802bb42bc 6.5.0-17-generic #17-Ubuntu SMP PREEMPT_DYNAMIC Thu Jan 11 14:01:59 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux`

Contributor guide

Open the contributing guide

Research direction

Start at the fdb_network_set_option() entry point and compare the byte and path options with the environment-variable configuration, using the reported TLS certificate verification failure as the symptom to reproduce. Done means the in-memory byte and path options establish the same successful TLS connection as the corresponding FDB_TLS_* files.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
databases, networking, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.