<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof">
Hi,</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof">
We use the <span style="display: inline !important; background-color: rgb(255, 255, 255);" class="ContentPasted1">
vmod<span class="ContentPasted1"> </span></span>crypto to verify <span style="font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen-Sans, Ubuntu, Cantarell, "Helvetica Neue", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji"; text-align: left; display: inline !important; color: rgb(46, 46, 46); background-color: rgb(255, 255, 255);" class="ContentPasted0">cryptographic
signatures for some of our traffic. When testing, the public key was hard coded in the VCL, but before we start using this feature in production we will switch to reading the public key from a file on disk. This file is generated on server startup, by fetching
it from an Azure keyvault.</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof">
<span style="font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen-Sans, Ubuntu, Cantarell, "Helvetica Neue", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji"; text-align: left; display: inline !important; color: rgb(46, 46, 46); background-color: rgb(255, 255, 255);" class="ContentPasted0"><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof">
<span style="font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen-Sans, Ubuntu, Cantarell, "Helvetica Neue", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji"; text-align: left; display: inline !important; color: rgb(46, 46, 46); background-color: rgb(255, 255, 255);" class="ContentPasted0">Now,
the problem I'm picturing here is that this fetching of the public key can fail, or the key can be corrupt or empty, maybe by user error. Or the key could be valid, but the format of the key happens to be unsupported by the <span class="ContentPasted1 ContentPasted2" style="font-family: Calibri, Helvetica, sans-serif; margin: 0px; text-align: start; display: inline !important; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">vmod<span class="ContentPasted1 ContentPasted2" style="margin:0px"> </span></span><span style="font-family: Calibri, Helvetica, sans-serif; text-align: start; display: inline !important; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="ContentPasted2">crypto.
So, even if we do our best to validate the key, in theory it could pass all our tests but still fail when we give it to the <span class="ContentPasted1" style="margin: 0px; display: inline !important; background-color: rgb(255, 255, 255);">vmod<span class="ContentPasted1" style="margin:0px"> </span></span><span style="display: inline !important; background-color: rgb(255, 255, 255);">crypto.
And if that happens, Varnish won't start because the <span class="ContentPasted1 ContentPasted3" style="margin: 0px; display: inline !important; background-color: rgb(255, 255, 255);">vmod<span class="ContentPasted1 ContentPasted3" style="margin:0px"> </span></span><span style="display: inline !important; background-color: rgb(255, 255, 255);" class="ContentPasted3">crypto<span class="ContentPasted3 ContentPasted4"> is
initiated with the public key in vcl_init, like this:</span></span><span></span></span></span></span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof">
<span style="font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen-Sans, Ubuntu, Cantarell, "Helvetica Neue", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji"; text-align: left; display: inline !important; color: rgb(46, 46, 46); background-color: rgb(255, 255, 255);" class="ContentPasted0"><span style="font-family: Calibri, Helvetica, sans-serif; text-align: start; display: inline !important; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="ContentPasted2"><span style="display: inline !important; background-color: rgb(255, 255, 255);"><span style="display: inline !important; background-color: rgb(255, 255, 255);" class="ContentPasted3"><span class="ContentPasted3 ContentPasted4"><br>
</span></span></span></span></span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof">
<span style="font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen-Sans, Ubuntu, Cantarell, "Helvetica Neue", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji"; text-align: left; display: inline !important; color: rgb(46, 46, 46); background-color: rgb(255, 255, 255);" class="ContentPasted0"><span style="font-family: Calibri, Helvetica, sans-serif; text-align: start; display: inline !important; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="ContentPasted2"><span style="display: inline !important; background-color: rgb(255, 255, 255);"><span style="display: inline !important; background-color: rgb(255, 255, 255);" class="ContentPasted3"><span class="ContentPasted3 ContentPasted4 ContentPasted5">sub
vcl_init {<br>
</span></span></span></span></span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof">
<span style="font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen-Sans, Ubuntu, Cantarell, "Helvetica Neue", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji"; text-align: left; display: inline !important; color: rgb(46, 46, 46); background-color: rgb(255, 255, 255);" class="ContentPasted0"><span style="font-family: Calibri, Helvetica, sans-serif; text-align: start; display: inline !important; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="ContentPasted2"><span style="display: inline !important; background-color: rgb(255, 255, 255);"><span style="display: inline !important; background-color: rgb(255, 255, 255);" class="ContentPasted3"><span class="ContentPasted3 ContentPasted4 ContentPasted5 ContentPasted6"> new
cryptoVerifier = crypto.verifier(sha256, std.fileread("/path/to/public.key"));</span></span></span></span></span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof">
<span style="font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen-Sans, Ubuntu, Cantarell, "Helvetica Neue", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji"; text-align: left; display: inline !important; color: rgb(46, 46, 46); background-color: rgb(255, 255, 255);" class="ContentPasted0"><span style="font-family: Calibri, Helvetica, sans-serif; text-align: start; display: inline !important; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="ContentPasted2"><span style="display: inline !important; background-color: rgb(255, 255, 255);"><span style="display: inline !important; background-color: rgb(255, 255, 255);" class="ContentPasted3"><span class="ContentPasted3 ContentPasted4 ContentPasted5">}</span></span></span></span></span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof">
<span style="font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen-Sans, Ubuntu, Cantarell, "Helvetica Neue", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji"; text-align: left; display: inline !important; color: rgb(46, 46, 46); background-color: rgb(255, 255, 255);" class="ContentPasted0"><span style="font-family: Calibri, Helvetica, sans-serif; text-align: start; display: inline !important; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="ContentPasted2"><span style="display: inline !important; background-color: rgb(255, 255, 255);"><span style="display: inline !important; background-color: rgb(255, 255, 255);" class="ContentPasted3"><span class="ContentPasted3 ContentPasted4 ContentPasted5"><br>
</span></span></span></span></span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof">
<span style="font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen-Sans, Ubuntu, Cantarell, "Helvetica Neue", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji"; text-align: left; display: inline !important; color: rgb(46, 46, 46); background-color: rgb(255, 255, 255);" class="ContentPasted0"><span style="font-family: Calibri, Helvetica, sans-serif; text-align: start; display: inline !important; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="ContentPasted2"><span style="display: inline !important; background-color: rgb(255, 255, 255);"><span style="display: inline !important; background-color: rgb(255, 255, 255);" class="ContentPasted3"><span class="ContentPasted3 ContentPasted4 ContentPasted5">What
I would prefer to happen if the key is rejected, is that <span style="display: inline !important; background-color: rgb(255, 255, 255);" class="ContentPasted7">vcl_init<span class="ContentPasted7"> goes through without failure, and then the requests that use
the <span style="display: inline !important; background-color: rgb(255, 255, 255);" class="ContentPasted8">cryptoVerifier<span class="ContentPasted8"> will fail, but all other traffic (like 99%) still works. Can we achieve this somehow? Like some try-catch
functionallity? If not, is there some other way to handle this that doesn't cause Varnish to die on startup?</span></span></span></span></span></span></span></span></span></div>
</body>
</html>