api: remove ssl

`OpenSslDialer` and all of the helper functions
and tests were rellocated to the `go-tlsdialer`[1]
package. So now we can safely remove all the
copy-pasted code from `go-tarantool`.

This way, in order to use ssl, user should import
the `go-tlsdialer` package and call functions
from there.

[1] https://github.com/tarantool/go-tlsdialer

Part of #301

Author: DerekBum

.github/workflows/testing.yml

@@ -103,11 +103,6 @@ jobs:
           make test
           make testrace
 
-      - name: Run regression tests with disabled SSL
-        run: |
-          make test TAGS="go_tarantool_ssl_disable"
-          make testrace TAGS="go_tarantool_ssl_disable"
-
       - name: Run fuzzing tests
         if: ${{ matrix.fuzzing }}
         run: make fuzzing TAGS="go_tarantool_decimal_fuzzing"
@@ -149,16 +144,13 @@ jobs:
           - 'sdk-1.10.15-0-r598'
         coveralls: [false]
         fuzzing: [false]
-        ssl: [false]
         include:
           - sdk-path: 'release/linux/x86_64/2.10/'
             sdk-version: 'sdk-gc64-2.10.8-0-r598.linux.x86_64'
             coveralls: false
-            ssl: true
           - sdk-path: 'release/linux/x86_64/2.11/'
             sdk-version: 'sdk-gc64-2.11.1-0-r598.linux.x86_64'
             coveralls: true
-            ssl: true
 
     steps:
       - name: Clone the connector
@@ -195,14 +187,6 @@ jobs:
           source tarantool-enterprise/env.sh
           make test
           make testrace
-        env:
-          TEST_TNT_SSL: ${{matrix.ssl}}
-
-      - name: Run regression tests with disabled SSL
-        run: |
-          source tarantool-enterprise/env.sh
-          make test TAGS="go_tarantool_ssl_disable"
-          make testrace TAGS="go_tarantool_ssl_disable"
 
       - name: Run fuzzing tests
         if: ${{ matrix.fuzzing }}
@@ -212,7 +196,6 @@ jobs:
         if: ${{ matrix.coveralls }}
         env:
           COVERALLS_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          TEST_TNT_SSL: ${{matrix.ssl}}
         run: |
           source tarantool-enterprise/env.sh
           make coveralls
@@ -376,12 +359,6 @@ jobs:
           make test
           make testrace
 
-      - name: Run regression tests with disabled SSL
-        run: |
-          cd "${SRCDIR}"
-          make test TAGS="go_tarantool_ssl_disable"
-          make testrace TAGS="go_tarantool_ssl_disable"
-
       - name: Run fuzzing tests
         if: ${{ matrix.fuzzing }}
         run: |

CHANGELOG.md

@@ -15,7 +15,6 @@ Versioning](http://semver.org/spec/v2.0.0.html) except to the first release.
 - IsNullable flag for Field (#302)
 - More linters on CI (#310)
 - Meaningful description for read/write socket errors (#129)
-- Support password and password file to decrypt private SSL key file (#319)
 - Support `operation_data` in `crud.Error` (#330) 
 - Support `fetch_latest_metadata` option for crud requests with metadata (#335)
 - Support `noreturn` option for data change crud requests (#335)

CONTRIBUTING.md

@@ -34,20 +34,6 @@ make testrace
 The tests set up all required `tarantool` processes before run and clean up
 afterwards.
 
-If you want to run the tests with specific build tags:
-```bash
-make test TAGS=go_tarantool_ssl_disable
-make testrace TAGS=go_tarantool_ssl_disable
-```
-
-If you have Tarantool Enterprise Edition 2.10 or newer, you can run additional
-SSL tests. To do this, you need to set an environment variable 'TEST_TNT_SSL':
-
-```bash
-TEST_TNT_SSL=true make test
-TEST_TNT_SSL=true make testrace
-```
-
 If you want to run the tests for a specific package:
 ```bash
 make test-<SUBDIR>

README.md

@@ -68,11 +68,7 @@ We define multiple [build tags](https://pkg.go.dev/go/build#hdr-Build_Constraint
 
 This allows us to introduce new features without losing backward compatibility.
 
-1. To disable SSL support and linking with OpenSSL, you can use the tag:
-   ```
-   go_tarantool_ssl_disable
-   ```
-2. To run fuzz tests with decimals, you can use the build tag:
+1. To run fuzz tests with decimals, you can use the build tag:
    ```
    go_tarantool_decimal_fuzzing
    ```
@@ -169,6 +165,57 @@ otherwise it will have a description which can be retrieved with `err.Error()`.
 by the method `Do` of object `conn` which is the object that was returned
 by `Connect()`.
 
+### Example with openssl
+
+To use the SSL dialer a
+[`go-tlsdialer`](https://github.com/tarantool/go-tlsdialer) package should be
+imported:
+
+```go
+package tarantool
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/tarantool/go-tarantool/v2"
+	"github.com/tarantool/go-tlsdialer"
+)
+
+func main() {
+	sslDialer := tlsdialer.OpenSslDialer{
+		Address:     "127.0.0.1:3013", 
+		User:        "test", 
+		Password:    "test", 
+		SslKeyFile:  "testdata/localhost.key",
+		SslCertFile: "testdata/localhost.crt",
+		SslCaFile:   "testdata/ca.crt",
+	}
+	opts := tarantool.Opts{
+		Timeout: time.Second,
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 500*time.Millisecond)
+	defer cancel()
+	conn, err := tarantool.Connect(ctx, sslDialer, opts)
+	if err != nil {
+		fmt.Printf("Connection refused: %s", err)
+	}
+
+	data, err := conn.Do(tarantool.NewInsertRequest(999).
+		Tuple([]interface{}{99999, "BB"}), 
+	).Get()
+	if err != nil {
+		fmt.Printf("Error: %s", err)
+	} else {
+		fmt.Printf("Data: %v", data)
+	}
+}
+```
+
+Note that SSL is enabled only on Tarantool Enterprise Edition 2.10 or newer.
+
 ### Migration to v2
 
 The article describes migration from go-tarantool to go-tarantool/v2.
@@ -315,8 +362,10 @@ and user may cancel it in process.
 
 Now you need to pass `Dialer` as the second argument instead of URI.
 If you were using a non-SSL connection, you need to create `NetDialer`.
-For SSL-enabled connections, use `OpenSslDialer`. Please note that the options
-for creating a connection are now stored in corresponding `Dialer`, not in `Opts`.
+For SSL-enabled connections, use `tlsdialer.OpenSslDialer` of the `go-tlsdialer`
+package.
+Please note that the options for creating a connection are now stored in
+corresponding `Dialer`, not in `Opts`.
 
 #### Connection schema
 

dial.go

@@ -205,115 +205,6 @@ func (d NetDialer) Dial(ctx context.Context, opts DialOpts) (Conn, error) {
 	return dialer.Dial(ctx, opts)
 }
 
-type openSslDialer struct {
-	address         string
-	sslKeyFile      string
-	sslCertFile     string
-	sslCaFile       string
-	sslCiphers      string
-	sslPassword     string
-	sslPasswordFile string
-}
-
-func (d openSslDialer) Dial(ctx context.Context, opts DialOpts) (Conn, error) {
-	var err error
-	conn := new(tntConn)
-
-	network, address := parseAddress(d.address)
-	conn.net, err = sslDialContext(ctx, network, address, sslOpts{
-		KeyFile:      d.sslKeyFile,
-		CertFile:     d.sslCertFile,
-		CaFile:       d.sslCaFile,
-		Ciphers:      d.sslCiphers,
-		Password:     d.sslPassword,
-		PasswordFile: d.sslPasswordFile,
-	})
-	if err != nil {
-		return nil, fmt.Errorf("failed to dial: %w", err)
-	}
-
-	dc := &deadlineIO{to: opts.IoTimeout, c: conn.net}
-	conn.reader = bufio.NewReaderSize(dc, bufSize)
-	conn.writer = bufio.NewWriterSize(dc, bufSize)
-
-	return conn, nil
-}
-
-// OpenSslDialer allows to use SSL transport for connection.
-type OpenSslDialer struct {
-	// Address is an address to connect.
-	// It could be specified in following ways:
-	//
-	// - TCP connections (tcp://192.168.1.1:3013, tcp://my.host:3013,
-	// tcp:192.168.1.1:3013, tcp:my.host:3013, 192.168.1.1:3013, my.host:3013)
-	//
-	// - Unix socket, first '/' or '.' indicates Unix socket
-	// (unix:///abs/path/tnt.sock, unix:path/tnt.sock, /abs/path/tnt.sock,
-	// ./rel/path/tnt.sock, unix/:path/tnt.sock)
-	Address string
-	// Auth is an authentication method.
-	Auth Auth
-	// Username for logging in to Tarantool.
-	User string
-	// User password for logging in to Tarantool.
-	Password string
-	// RequiredProtocol contains minimal protocol version and
-	// list of protocol features that should be supported by
-	// Tarantool server. By default, there are no restrictions.
-	RequiredProtocolInfo ProtocolInfo
-	// SslKeyFile is a path to a private SSL key file.
-	SslKeyFile string
-	// SslCertFile is a path to an SSL certificate file.
-	SslCertFile string
-	// SslCaFile is a path to a trusted certificate authorities (CA) file.
-	SslCaFile string
-	// SslCiphers is a colon-separated (:) list of SSL cipher suites the connection
-	// can use.
-	//
-	// We don't provide a list of supported ciphers. This is what OpenSSL
-	// does. The only limitation is usage of TLSv1.2 (because other protocol
-	// versions don't seem to support the GOST cipher). To add additional
-	// ciphers (GOST cipher), you must configure OpenSSL.
-	//
-	// See also
-	//
-	// * https://www.openssl.org/docs/man1.1.1/man1/ciphers.html
-	SslCiphers string
-	// SslPassword is a password for decrypting the private SSL key file.
-	// The priority is as follows: try to decrypt with SslPassword, then
-	// try SslPasswordFile.
-	SslPassword string
-	// SslPasswordFile is a path to the list of passwords for decrypting
-	// the private SSL key file. The connection tries every line from the
-	// file as a password.
-	SslPasswordFile string
-}
-
-// Dial makes OpenSslDialer satisfy the Dialer interface.
-func (d OpenSslDialer) Dial(ctx context.Context, opts DialOpts) (Conn, error) {
-	dialer := AuthDialer{
-		Dialer: ProtocolDialer{
-			Dialer: GreetingDialer{
-				Dialer: openSslDialer{
-					address:         d.Address,
-					sslKeyFile:      d.SslKeyFile,
-					sslCertFile:     d.SslCertFile,
-					sslCaFile:       d.SslCaFile,
-					sslCiphers:      d.SslCiphers,
-					sslPassword:     d.SslPassword,
-					sslPasswordFile: d.SslPasswordFile,
-				},
-			},
-			RequiredProtocolInfo: d.RequiredProtocolInfo,
-		},
-		Auth:     d.Auth,
-		Username: d.User,
-		Password: d.Password,
-	}
-
-	return dialer.Dial(ctx, opts)
-}
-
 type fdAddr struct {
 	Fd uintptr
 }

dial_test.go

@@ -406,21 +406,6 @@ var (
 		0xfe, 0xc7, 0x24, 0x5a, 0xe6, 0xe8, 0x31,
 	}
 
-	authRequestExpectedPapSha256 = []byte{
-		0xce, 0x00, 0x00, 0x00, 0x2a, // Length.
-		0x82, // Header map.
-		0x00, 0x07,
-		0x01, 0xce, 0x00, 0x00, 0x00, 0x00,
-
-		0x82, // Data map.
-		0xce, 0x00, 0x00, 0x00, 0x23,
-		0xa4, 't', 'e', 's', 't', // Login.
-		0xce, 0x00, 0x00, 0x00, 0x21,
-		0x92, // Tuple.
-		0xaa, 'p', 'a', 'p', '-', 's', 'h', 'a', '2', '5', '6',
-		0xa4, 't', 'e', 's', 't',
-	}
-
 	okResponse = []byte{
 		0xce, 0x00, 0x00, 0x00, 19, // Length.
 		0x83, // Header map.
@@ -442,7 +427,6 @@ type testDialOpts struct {
 	isErrGreeting   bool
 	isErrId         bool
 	isIdUnsupported bool
-	isPapSha256Auth bool
 	isErrAuth       bool
 	isEmptyAuth     bool
 }
@@ -485,9 +469,7 @@ func testDialAccept(opts testDialOpts, l net.Listener) chan dialServerActual {
 
 		// Read Auth request.
 		authRequestExpected := authRequestExpectedChapSha1
-		if opts.isPapSha256Auth {
-			authRequestExpected = authRequestExpectedPapSha256
-		} else if opts.isEmptyAuth {
+		if opts.isEmptyAuth {
 			authRequestExpected = []byte{}
 		}
 		authRequestActual := make([]byte, len(authRequestExpected))
@@ -530,9 +512,7 @@ func testDialer(t *testing.T, l net.Listener, dialer tarantool.Dialer,
 	require.Equal(t, idRequestExpected, actual.IdRequest)
 
 	authRequestExpected := authRequestExpectedChapSha1
-	if opts.isPapSha256Auth {
-		authRequestExpected = authRequestExpectedPapSha256
-	} else if opts.isEmptyAuth {
+	if opts.isEmptyAuth {
 		authRequestExpected = []byte{}
 	}
 	require.Equal(t, authRequestExpected, actual.AuthRequest)

example_test.go

@@ -31,24 +31,6 @@ func exampleConnect(dialer tarantool.Dialer, opts tarantool.Opts) *tarantool.Con
 	return conn
 }
 
-// Example demonstrates how to use SSL transport.
-func ExampleOpenSslDialer() {
-	sslDialer := tarantool.OpenSslDialer{
-		Address:     "127.0.0.1:3013",
-		User:        "test",
-		Password:    "test",
-		SslKeyFile:  "testdata/localhost.key",
-		SslCertFile: "testdata/localhost.crt",
-		SslCaFile:   "testdata/ca.crt",
-	}
-	ctx, cancel := context.WithTimeout(context.Background(), 500*time.Millisecond)
-	defer cancel()
-	_, err := tarantool.Connect(ctx, sslDialer, opts)
-	if err != nil {
-		panic("Connection is not established: " + err.Error())
-	}
-}
-
 func ExampleIntKey() {
 	conn := exampleConnect(dialer, opts)
 	defer conn.Close()

export_test.go

@@ -6,19 +6,6 @@ import (
 	"github.com/vmihailenco/msgpack/v5"
 )
 
-type SslTestOpts struct {
-	KeyFile      string
-	CertFile     string
-	CaFile       string
-	Ciphers      string
-	Password     string
-	PasswordFile string
-}
-
-func SslCreateContext(opts SslTestOpts) (ctx interface{}, err error) {
-	return sslCreateContext(sslOpts(opts))
-}
-
 // RefImplPingBody is reference implementation for filling of a ping
 // request's body.
 func RefImplPingBody(enc *msgpack.Encoder) error {