Follow symlinks for TLS certificate #700

New Issue

2026-10-05T04:39:27+02:00

adam commented

2026-10-05 04:39:27 +02:00

It is sometimes convenient to simply provide a symlink that points at the actual TLS certificate. Up to ZNC 1.7.x-git-701-15ae561, it looks like it stats the file, then errors out with

Binding to port [+1234] using ipv4... [ Unable to locate pem file: [/path/to/znc.pem] ]
Unrecoverable config error.

Instead, znc should follow such symlinks.

It is sometimes convenient to simply provide a symlink that points at the actual TLS certificate. Up to ZNC 1.7.x-git-701-15ae561, it looks like it stats the file, then errors out with ``` Binding to port [+1234] using ipv4... [ Unable to locate pem file: [/path/to/znc.pem] ] Unrecoverable config error. ``` Instead, znc should follow such symlinks.

adam closed this issue

2026-10-05 04:39:27 +02:00

adam commented

2026-10-05 04:39:28 +02:00

Are you really, really sure that you got the path to the symlink and the symlink correct?

Looking at the code, it just checks if the file exists [1] and the method that it uses for this just stat()s the file. So symlinks should just work.

[1] https://github.com/znc/znc/blob/b45617cb59ee1729d6288c1242a22cae785c5e4b/src/znc.cpp#L1724-L1726
[2] https://github.com/znc/znc/blob/b45617cb59ee1729d6288c1242a22cae785c5e4b/src/FileUtils.cpp#L159-L162

Are you really, really sure that you got the path to the symlink and the symlink correct? Looking at the code, it just checks if the file exists [1] and the method that it uses for this just `stat()`s the file. So symlinks should just work. [1] https://github.com/znc/znc/blob/b45617cb59ee1729d6288c1242a22cae785c5e4b/src/znc.cpp#L1724-L1726 [2] https://github.com/znc/znc/blob/b45617cb59ee1729d6288c1242a22cae785c5e4b/src/FileUtils.cpp#L159-L162

adam commented

2026-10-05 04:39:29 +02:00

Wow, made a bunch of mistakes here.

I also had two versions of znc on the system, so which one was executed depended on how I executed it (ie relying on $PATH vs init script vs executing the binary directly) and I never noticed.

I also misunderstood what strace was telling me. In particular, I thought znc was asking stat if the file was a regular file, and seeing that it wasn't. In reality, S_IFREG indicates that stat is saying that the file is a regular file. (which is still weird, because I'd expect to see S_IFLINK)

And, you're right: this works just fine. Because I wasn't looking at the logs corresponding to what I was actually running, I didn't see the real and unrelated failure.

Wow, made a bunch of mistakes here. I also had two versions of znc on the system, so which one was executed depended on how I executed it (ie relying on $PATH vs init script vs executing the binary directly) and I never noticed. I also misunderstood what strace was telling me. In particular, I thought znc was asking stat _if_ the file was a regular file, and seeing that it wasn't. In reality, S_IFREG indicates that stat is saying that the file is a regular file. (which is still weird, because I'd expect to see S_IFLINK) And, you're right: this works just fine. Because I wasn't looking at the logs corresponding to what I was actually running, I didn't see the real and unrelated failure.

adam commented

2026-10-05 04:39:29 +02:00

which is still weird, because I'd expect to see S_IFLINK

This is the difference between stat() and lstat(). One follows symlinks, another looks at symlink itself.

> which is still weird, because I'd expect to see S_IFLINK This is the difference between `stat()` and `lstat()`. One follows symlinks, another looks at symlink itself.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: adam/znc#700