Skip to content
This repository was archived by the owner on Aug 21, 2020. It is now read-only.
This repository was archived by the owner on Aug 21, 2020. It is now read-only.

Issues with TLS client authentication #20

Description

@ThatIsGeek

While setting up Calico in our OpenStack deployment we've encountered issues when trying to use TLS authentication to access etcd cluster.

To reproduce:

  1. Setup etcd cluster with TLS client authentication
  2. Create new client c = Etcd3Client(host="server", protocol="https", ca_cert="server_ca.crt", cert_cert="user.crt", cert_key="user.key")
  3. try to get some random key c.get("random_key")
  4. You should get TLS alert bad certificate or CERTIFICATE_VERIFY_FAILED if you don't have server_ca in your system trust.

When looking through the source code we've noticed that the TLS parameters are stored in self.kwargs and then never used.

self.kwargs = {

When edited to actually set the values on the session object, the TLS auth started working.

Issue appeared on both Ubuntu Xenial (Python 2.7.12, OpenSSL 1.0.2g) and Fedora 27 (Python 2.7.14, OpenSSL 1.1.0h).

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions