{"record":{"id":"a896139342208f31","repo":"vi/websocat","slug":"lint-should-have-caught-the-missing-pkcs12-der-option","errorCode":null,"errorMessage":"lint should have caught the missing pkcs12_der option","messagePattern":"lint should have caught the missing pkcs12_der option","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/ssl_peer.rs","lineNumber":228,"sourceCode":"            let (r,w) = tls_stream.split();\n            ok(Peer::new(r,w, hup))\n        }))\n    }\n}\n\npub fn ssl_accept(inner_peer: Peer, _l2r: L2rUser, progopt: Rc<Options>) -> BoxedNewPeerFuture {\n    let hup = inner_peer.2;\n    let squashed_peer = readwrite::ReadWriteAsync::new(inner_peer.0, inner_peer.1);\n\n    fn gettlsa(cert: &[u8], passwd: &str) -> native_tls::Result<TlsAcceptorExt> {\n        let pkcs12 = Pkcs12::from_pkcs12(cert, passwd)?;\n        Ok(TlsAcceptorExt::from(TlsAcceptor::builder(pkcs12).build()?))\n    }\n\n    let der = progopt\n        .pkcs12_der\n        .as_ref()\n        .expect(\"lint should have caught the missing pkcs12_der option\");\n    let passwd = progopt\n        .pkcs12_passwd.as_deref()\n        .unwrap_or(\"\");\n    let tls = match gettlsa(der, passwd) {\n        Ok(x) => x,\n        Err(e) => return peer_err(e),\n    };\n\n    debug!(\"Accepting a TLS connection\");\n    Box::new(\n        tls.accept(squashed_peer)\n            .map_err(box_up_err)\n            .and_then(move |tls_stream| {\n                info!(\"Accepted TLS connection\");\n                match tls_stream.get_ref().peer_certificate() {\n                    Ok(Some(_cert)) => {\n                        // Does not actually work with native-tls\n                        info!(\"  the client presented an identity certificate.\");","sourceCodeStart":210,"sourceCodeEnd":246,"githubUrl":"https://github.com/vi/websocat/blob/3a3574cd2f5d17857d87f3982e72c3ede159dde0/src/ssl_peer.rs#L210-L246","documentation":"In ssl_accept, the pkcs12_der program option is unwrapped with expect because an earlier lint pass was supposed to reject configurations missing it. If you reach this point, the option is None and the pre-validation did not run or did not cover this code path, so the TLS acceptor cannot be built and the process panics instead of returning a clean error.","triggerScenarios":"Starting the program with --ssl (accept mode) without supplying --pkcs12-der, when the CLI lint/option-validation pass is bypassed — e.g. constructing options programmatically, a code path that skips the lint, or a regression that dropped the check.","commonSituations":"Enabling TLS on a listening socket without a certificate bundle; automation generating config where pkcs12_der is only set in some branches; upgrading and the old flag name no longer populates pkcs12_der.","solutions":["Provide the pkcs12_der option (the DER-encoded PKCS#12 bundle) along with --ssl in the command line/config","Fix the lint/validation pass so it rejects --ssl without pkcs12_der and reports a user-facing error before accept starts","If options are constructed in code, set progopt.pkcs12_der explicitly before calling ssl_accept","Change the expect into a graceful error return (peer_err) so a missing option yields a diagnostic instead of a panic"],"exampleFix":"// before\nlet der = progopt.pkcs12_der.as_ref()\n    .expect(\"lint should have caught the missing pkcs12_der option\");\n// after\nlet der = progopt.pkcs12_der.as_ref().ok_or_else(|| {\n    ConfigError::new(\"--ssl requires the pkcs12_der option\")\n})?;","handlingStrategy":"validation","validationCode":"if progopt.ssl && progopt.pkcs12_der.is_none() {\n    return Err(\"--ssl requires pkcs12_der (PKCS#12 bundle) to be set\");\n}","typeGuard":"fn has_tls_bundle(o: &ProgramOptions) -> bool {\n    o.pkcs12_der.as_ref().map(|d| !d.is_empty()).unwrap_or(false)\n}","tryCatchPattern":"// expect() panics cannot be caught by Result handling; validate first or catch_unwind\nlet tls = std::panic::catch_unwind(|| start_ssl_accept(&progopt));","preventionTips":["Always pair --ssl with a pkcs12_der bundle in launch scripts","Add a startup config validation that fails fast with a clear message","Keep the lint option-check in sync with every new code path that reads pkcs12_der","When constructing ProgramOptions in code, assert the bundle is present before ssl_accept"],"tags":["tls","ssl","config","panic"],"backgroundTag":"missing-required-config-field","analyzedSha":"3a3574cd2f5d17857d87f3982e72c3ede159dde0","analyzedAt":"2026-09-12T15:14:27.766Z","contentChangedAt":"2026-09-12T15:14:27.766Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}