Disable hostname checking on controller connection (#305) · VariableDeclared/python-libjuju@47ef7ca · GitHub

1. VariableDeclared
2. python-libjuju

Repository navigation

• Code
• Pull requests
• Actions
• Projects
• Security and quality
• Insights

Commit 47ef7ca

Browse filesBrowse the repository at this point in the historyBrowse files

johnsca

authored and

Adam Stokes

committed

Disable hostname checking on controller connection (juju#305)

The hostnames listed in the controller cert don't include the IP address which is typically what the endpoint address uses for self-bootstrapped controllers. This means the hostname check will always fail for that case. However, since we pre-share and trust the cert from the connection info, along with the endpoint address, it is safe to skip that check during the connection. Fixes juju#302

1 parent ce1d6b5 commit 47ef7ca
Copy full SHA for 47ef7ca

1 file changed

+10-1Lines changed: 10 additions & 1 deletion

File tree

Expand file treeCollapse file tree

Open diff view settings

Filter options

• juju/client
  • connection.py

Expand file treeCollapse file tree

Open diff view settings

Collapse file

‎juju/client/connection.py‎

Copy file name to clipboardExpand all lines: juju/client/connection.py

+10-1Lines changed: 10 additions & 1 deletion

Original file line number	Diff line number	Diff line change
@@ -189,8 +189,17 @@ def is_open(self):
189	189	return self.monitor.status == Monitor.CONNECTED
190	190
191	191	def _get_ssl(self, cert=None):
192		- return ssl.create_default_context(
	192	+ context = ssl.create_default_context(
193	193	purpose=ssl.Purpose.SERVER_AUTH, cadata=cert)
	194	+ if cert:
	195	+ # Disable hostname checking if and only if we have an explicit cert
	196	+ # to validate against, because the cert doesn't contain the IP addr
	197	+ # of the controller, which is what self-bootstrapped controllers
	198	+ # use. And because we pre-share and trust both the cert and
	199	+ # endpoint address anyway, it's safe to skip that check.
	200	+ # See: https://github.com/juju/python-libjuju/issues/302
	201	+ context.check_hostname = False
	202	+ return context
194	203
195	204	async def _open(self, endpoint, cacert):
196	205	if self.uuid:

0 commit comments

Comments

0 (0)