Skip to content
This repository has been archived by the owner on Aug 21, 2020. It is now read-only.

Issues with TLS client authentication #20

Open
ThatIsGeek opened this issue May 7, 2018 · 2 comments
Open

Issues with TLS client authentication #20

ThatIsGeek opened this issue May 7, 2018 · 2 comments

Comments

@ThatIsGeek
Copy link
Contributor

ThatIsGeek commented May 7, 2018

While setting up Calico in our OpenStack deployment we've encountered issues when trying to use TLS authentication to access etcd cluster.

To reproduce:

  1. Setup etcd cluster with TLS client authentication
  2. Create new client c = Etcd3Client(host="server", protocol="https", ca_cert="server_ca.crt", cert_cert="user.crt", cert_key="user.key")
  3. try to get some random key c.get("random_key")
  4. You should get TLS alert bad certificate or CERTIFICATE_VERIFY_FAILED if you don't have server_ca in your system trust.

When looking through the source code we've noticed that the TLS parameters are stored in self.kwargs and then never used.

self.kwargs = {

When edited to actually set the values on the session object, the TLS auth started working.

Issue appeared on both Ubuntu Xenial (Python 2.7.12, OpenSSL 1.0.2g) and Fedora 27 (Python 2.7.14, OpenSSL 1.1.0h).

@dims
Copy link
Owner

dims commented May 7, 2018

@ThatIsGeek can you please submit a patch?

@ThatIsGeek
Copy link
Contributor Author

@dims sure :) I am already working on it. Sorry for not mentioning it in the report.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants