v0.34.10

src/tls/external_paths.rs

@@ -104,7 +104,9 @@ fn read_pem_with_policy(
     #[cfg(unix)]
     {
         use std::os::unix::fs::OpenOptionsExt;
-        options.custom_flags(libc::O_NOFOLLOW);
+        // Reject special files below without blocking while opening a FIFO.
+        // O_NONBLOCK has no effect on ordinary certificate/key files.
+        options.custom_flags(libc::O_NOFOLLOW | libc::O_NONBLOCK);
     }
     let file = options
         .open(path)

src/tls/external_paths_tests.rs

@@ -127,3 +127,21 @@ fn external_paths_reject_writable_non_sticky_parent_directories() {
     fs::write(&cert, b"dummy").unwrap();
     assert!(configured_certificate_path(root.path(), cert.to_str().unwrap()).is_err());
 }
+
+#[cfg(unix)]
+#[test]
+fn certificate_input_rejects_fifo_without_waiting_for_a_writer() {
+    use std::os::unix::ffi::OsStrExt;
+
+    let root = tempfile::tempdir().unwrap();
+    let fifo = root.path().join("certificate.pipe");
+    let path = std::ffi::CString::new(fifo.as_os_str().as_bytes()).unwrap();
+    assert_eq!(unsafe { libc::mkfifo(path.as_ptr(), 0o600) }, 0);
+    let (send, receive) = std::sync::mpsc::channel();
+    std::thread::spawn(move || {
+        let _ = send.send(read_pem_with_policy(&fifo, false, false).is_err());
+    });
+    assert!(receive
+        .recv_timeout(std::time::Duration::from_secs(2))
+        .expect("certificate reads must reject a FIFO without blocking"));
+}