Bug #18890: [sdk] bring the python keep SDK in line with ARVADOS_API_HOST_INSECURE - Arvados

Actions

Copy link

Bug #18890

closed

[sdk] bring the python keep SDK in line with ARVADOS_API_HOST_INSECURE

Added by Ward Vandewege almost 3 years ago. Updated over 2 years ago.

Status:

Resolved

Priority:

Normal

Assigned To:

Ward Vandewege

Category:

Target version:

2022-03-30 Sprint

Start date:

03/17/2022

Due date:

% Done:

100%

Estimated time:

(Total: 0.00 h)

Story points:

Release:

Arvados 2.4.0

Release relationship:

Auto

Description

ARVADOS_API_HOST_INSECURE is interpreted in our codebase as "do not validate TLS certificate validity". This includes "do not check if the hostname matches the name on the certificate".

The Python SDK keep code is a bit of an outlier, because it only disables pycurl.SSL_VERIFYPEER when ARVADOS_API_HOST_INSECURE is set, which means the certificate validity check is disabled, but the hostname on the certificate still needs to match the hostname connected to.

libcurl has another flag to disable the hostname check, pycurl.SSL_VERIFYHOST (it's called CURLOPT_SSL_VERIFYHOST in https://curl.se/libcurl/c/curl_easy_setopt.html).

We should also disable pycurl.SSL_VERIFYHOST when ARVADOS_API_HOST_INSECURE is set, for consistency's sake.

Subtasks 1 (0 open — 1 closed)