From ed472245402c48ba1f6bcff810612207aa45c044 Mon Sep 17 00:00:00 2001 From: Alexander Kukushkin Date: Tue, 6 Dec 2022 17:24:57 +0100 Subject: [PATCH] Improve behaviour of the insecure option (#2476) It didn't worked correctly when client certificates are used for REST API requests. --- patroni/request.py | 13 ++++++++++--- postgres0.yml | 10 ++++++---- postgres1.yml | 10 ++++++---- postgres2.yml | 10 ++++++---- 4 files changed, 28 insertions(+), 15 deletions(-) diff --git a/patroni/request.py b/patroni/request.py index dfc0a625..fce02e01 100644 --- a/patroni/request.py +++ b/patroni/request.py @@ -9,9 +9,9 @@ from .utils import USER_AGENT class PatroniRequest(object): - def __init__(self, config, insecure=False): - cert_reqs = 'CERT_NONE' if insecure or config.get('ctl', {}).get('insecure', False) else 'CERT_REQUIRED' - self._pool = urllib3.PoolManager(num_pools=10, maxsize=10, cert_reqs=cert_reqs) + def __init__(self, config, insecure=None): + self._insecure = insecure + self._pool = urllib3.PoolManager(num_pools=10, maxsize=10) self.reload_config(config) @staticmethod @@ -32,12 +32,19 @@ class PatroniRequest(object): def reload_config(self, config): self._pool.headers = urllib3.make_headers(basic_auth=self._get_cfg_value(config, 'auth'), user_agent=USER_AGENT) + insecure = self._insecure if isinstance(self._insecure, bool) else config.get('ctl', {}).get('insecure', False) if self._apply_ssl_file_param(config, 'cert'): + # With client certificate the cert_reqs must be set to CERT_REQUIRED even if insecure option is used + self._pool.connection_pool_kw['cert_reqs'] = 'CERT_REQUIRED' + # The assert_hostname = False helps to silence warnings + self._pool.connection_pool_kw['assert_hostname'] = False if insecure else None + self._apply_ssl_file_param(config, 'key') password = self._get_cfg_value(config, 'keyfile_password') self._apply_pool_param('key_password', password) else: + self._pool.connection_pool_kw['cert_reqs'] = 'CERT_NONE' if insecure else 'CERT_REQUIRED' self._pool.connection_pool_kw.pop('key_file', None) cacert = config.get('ctl', {}).get('cacert') or config.get('restapi', {}).get('cafile') diff --git a/postgres0.yml b/postgres0.yml index c10b847a..ebc67426 100644 --- a/postgres0.yml +++ b/postgres0.yml @@ -5,16 +5,18 @@ name: postgresql0 restapi: listen: 127.0.0.1:8008 connect_address: 127.0.0.1:8008 +# cafile: /etc/ssl/certs/ssl-cacert-snakeoil.pem # certfile: /etc/ssl/certs/ssl-cert-snakeoil.pem # keyfile: /etc/ssl/private/ssl-cert-snakeoil.key # authentication: # username: username # password: password -# ctl: -# insecure: false # Allow connections to SSL sites without certs -# certfile: /etc/ssl/certs/ssl-cert-snakeoil.pem -# cacert: /etc/ssl/certs/ssl-cacert-snakeoil.pem +#ctl: +# insecure: false # Allow connections to Patroni REST API without verifying certificates +# certfile: /etc/ssl/certs/ssl-cert-snakeoil.pem +# keyfile: /etc/ssl/private/ssl-cert-snakeoil.key +# cacert: /etc/ssl/certs/ssl-cacert-snakeoil.pem etcd: #Provide host to do the initial discovery of the cluster topology: diff --git a/postgres1.yml b/postgres1.yml index 9e58ace8..21993a4d 100644 --- a/postgres1.yml +++ b/postgres1.yml @@ -5,16 +5,18 @@ name: postgresql1 restapi: listen: 127.0.0.1:8009 connect_address: 127.0.0.1:8009 +# cafile: /etc/ssl/certs/ssl-cacert-snakeoil.pem # certfile: /etc/ssl/certs/ssl-cert-snakeoil.pem # keyfile: /etc/ssl/private/ssl-cert-snakeoil.key # authentication: # username: username # password: password -# ctl: -# insecure: false # Allow connections to SSL sites without certs -# certfile: /etc/ssl/certs/ssl-cert-snakeoil.pem -# cacert: /etc/ssl/certs/ssl-cacert-snakeoil.pem +#ctl: +# insecure: false # Allow connections to Patroni REST API without verifying certificates +# certfile: /etc/ssl/certs/ssl-cert-snakeoil.pem +# keyfile: /etc/ssl/private/ssl-cert-snakeoil.key +# cacert: /etc/ssl/certs/ssl-cacert-snakeoil.pem etcd: #Provide host to do the initial discovery of the cluster topology: diff --git a/postgres2.yml b/postgres2.yml index 2b19bcd4..8612adcb 100644 --- a/postgres2.yml +++ b/postgres2.yml @@ -5,16 +5,18 @@ name: postgresql2 restapi: listen: 127.0.0.1:8010 connect_address: 127.0.0.1:8010 +# cafile: /etc/ssl/certs/ssl-cacert-snakeoil.pem # certfile: /etc/ssl/certs/ssl-cert-snakeoil.pem # keyfile: /etc/ssl/private/ssl-cert-snakeoil.key authentication: username: username password: password -# ctl: -# insecure: false # Allow connections to SSL sites without certs -# certfile: /etc/ssl/certs/ssl-cert-snakeoil.pem -# cacert: /etc/ssl/certs/ssl-cacert-snakeoil.pem +#ctl: +# insecure: false # Allow connections to Patroni REST API without verifying certificates +# certfile: /etc/ssl/certs/ssl-cert-snakeoil.pem +# keyfile: /etc/ssl/private/ssl-cert-snakeoil.key +# cacert: /etc/ssl/certs/ssl-cacert-snakeoil.pem etcd: #Provide host to do the initial discovery of the cluster topology: