ssl: check no sensitive ssl data in logs

[mrForza]

The safe_uri function is used in vshard to get a purged uri. Before #11810 patch sensitive ssl data may leaked into logs as uri.format function didn't handle ssl params of uri.

This patch explicitly sets write_sensitive parameter of uri.format into false in safe_uri function and add some tests which check that sensitive ssl data doesn't leak into logs of vshard storage and router.

NO_DOC=bugfix

Closes #593
Closes #597

[Serpentian]

Thank you for the patch! Great work, just some nits

P.S. I checked the tests manually, they seem ok, not flaky on my laptop. We don't have CI for EE, and I'm not sure, we can do that politically

[Serpentian]

The patch already looks great and I don't have any new comments regarding the code, let's just properly split the commits and call it a day. Good work

[Serpentian]

Thank you for the patches. Looks good!

[Gerold103]

Thanks 💪! Top work 🔥! I like how you've used this ticket as a chance to do a bit of cleanup around the related code.

[Gerold103]

This part of the commit message:

Since ssl
decided not to backport it. Vshard will work safely with ssl only on
related problems occurred in large numbers of tarantool verions, we
3.5 or above versions.

I somehow couldn't parse it at all. Could you rephrase?

[mrForza]

Yes, I can't parse it too) Something went wrong 🍸 🍾

[Gerold103]

Why do you need to start it without SSL and then configure it with SSL right away? Can you update the original cfg_template to simply already contain all the SSL params?

[mrForza]

It seems that we cannot simply pass is_ssl = true into cfg_template. The storages cannot be configured correctly.

Part of the test:

local g = t.group('router_ssl')
local cfg_template = {
    sharding = {
        {
            replicas = {
                replica_1_a = {
                    master = true,
                },
                replica_1_b = {},
            },
            is_ssl = true,
        },
        {
            replicas = {
                replica_2_a = {
                    master = true,
                },
                replica_2_b = {},
            },
            is_ssl = true,
        },
    },
    bucket_count = 100,
}
local global_cfg = vtest.config_new(cfg_template)

g.before_all(function()
    t.run_only_if(vutil.feature.ssl)
    vtest.cluster_new(g, global_cfg)
    vtest.cluster_bootstrap(g, global_cfg)
    vtest.cluster_rebalancer_disable(g)

    g.router = vtest.router_new(g, 'router', global_cfg)
    vtest.router_cfg(g.router, global_cfg)
    vtest.cluster_wait_fullsync(g)
end)

The logs:

replica_1_b | Incorrect value for option 'replication': Invalid URI table: expected {uri = string, params = table} or {string, params = table} {"type":"ClientError","code":59,"name":"CFG","o
ption":"replication","details":"Invalid URI table: expected {uri = string, params = table} or {string, params = table}","trace":[{"file":"[C]","line":4294967295}]}
replica_1_b | fatal error, exiting the event loop
replica_1_a | Incorrect value for option 'replication': Invalid URI table: expected {uri = string, params = table} or {string, params = table} {"type":"ClientError","code":59,"name":"CFG","o
ption":"replication","details":"Invalid URI table: expected {uri = string, params = table} or {string, params = table}","trace":[{"file":"[C]","line":4294967295}]}
replica_1_a | fatal error, exiting the event loop
replica_2_b | Incorrect value for option 'replication': Invalid URI table: expected {uri = string, params = table} or {string, params = table} {"type":"ClientError","code":59,"name":"CFG","o
ption":"replication","details":"Invalid URI table: expected {uri = string, params = table} or {string, params = table}","trace":[{"file":"[C]","line":4294967295}]}
replica_2_b | fatal error, exiting the event loop
replica_2_a | Incorrect value for option 'replication': Invalid URI table: expected {uri = string, params = table} or {string, params = table} {"type":"ClientError","code":59,"name":"CFG","o
ption":"replication","details":"Invalid URI table: expected {uri = string, params = table} or {string, params = table}","trace":[{"file":"[C]","line":4294967295}]}
replica_2_a | fatal error, exiting the event loop
not ok 1    router_ssl.test_no_ssl_sensitive_data_in_storage_logs
#   fiber is cancelled
#   stack traceback:
#       ...e/mrforza/Desktop/vshard/test/luatest_helpers/server.lua:107: in function 'wait_for_readiness'
#       /home/mrforza/Desktop/vshard/test/luatest_helpers/vtest.lua:228: in function 'cluster_new'
#       ...sktop/vshard/test/router-luatest/router_2_2_ssl_test.lua:34: in function <...sktop/vshard/test/router-luatest/router_2_2_ssl_test.lua:32>
#       ...
#       [C]: in function 'xpcall'
# Ran 1 tests in 15.300 seconds, 0 succeeded, 1 errored

AFAIU, we firstly should configure the cluster without ssl and then reconfigure it with ssl options

[Serpentian]

My bad, but the first commit actually closes the #597 and is needed for #593

[mrForza]

fixed