Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

cqlshlib/sslhandling.py: don't use empty userkey/usercert #84

Merged
merged 1 commit into from
May 9, 2024

Conversation

fruch
Copy link
Collaborator

@fruch fruch commented May 9, 2024

when configuration doesn't define usercert or userkey

we fail as the following:

Using CQL driver: <module 'cassandra' from '/opt/scylladb/share/cassandra/libexec/../lib/scylla-driver-3.26.3.zip/cassandra/__init__.py'>
Using connect timeout: 5 seconds
Using 'utf-8' encoding
Using ssl: True
Using cloudconf: None
Traceback (most recent call last):
  File "/opt/scylladb/share/cassandra/libexec/cqlsh.py", line 2706, in <module>
    main(*read_options(sys.argv[1:], os.environ))
  File "/opt/scylladb/share/cassandra/libexec/cqlsh.py", line 2647, in main
    shell = Shell(hostname,
            ^^^^^^^^^^^^^^^
  File "/opt/scylladb/share/cassandra/libexec/cqlsh.py", line 490, in __init__
    kwargs['ssl_context'] = sslhandling.ssl_settings(hostname, CONFIG_FILE) if ssl else None
                            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/scylladb/share/cassandra/libexec/../pylib/cqlshlib/sslhandling.py", line 89, in ssl_settings
    ssl_context.load_cert_chain(certfile=usercert,
TypeError: certfile should be a valid filesystem path
  • we don't call load_cert_chain anymore if any of the params are empty
  • and now we warn the user if it's missconfigured (if one is and the other isn't)

Fixes: #83

when configuration doesn't define `usercert` or `userkey`

we fail as the following:
```bash
Using CQL driver: <module 'cassandra' from '/opt/scylladb/share/cassandra/libexec/../lib/scylla-driver-3.26.3.zip/cassandra/__init__.py'>
Using connect timeout: 5 seconds
Using 'utf-8' encoding
Using ssl: True
Using cloudconf: None
Traceback (most recent call last):
  File "/opt/scylladb/share/cassandra/libexec/cqlsh.py", line 2706, in <module>
    main(*read_options(sys.argv[1:], os.environ))
  File "/opt/scylladb/share/cassandra/libexec/cqlsh.py", line 2647, in main
    shell = Shell(hostname,
            ^^^^^^^^^^^^^^^
  File "/opt/scylladb/share/cassandra/libexec/cqlsh.py", line 490, in __init__
    kwargs['ssl_context'] = sslhandling.ssl_settings(hostname, CONFIG_FILE) if ssl else None
                            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/scylladb/share/cassandra/libexec/../pylib/cqlshlib/sslhandling.py", line 89, in ssl_settings
    ssl_context.load_cert_chain(certfile=usercert,
TypeError: certfile should be a valid filesystem path
```

* we don't call load_cert_chain anymore if any of the params are empty
* and now we warn the user if it's missconfigured (if one is and the other isn't)

Fixes: scylladb#83
@fruch fruch requested review from Lorak-mmk and mykaul May 9, 2024 07:41
@fruch
Copy link
Collaborator Author

fruch commented May 9, 2024

I've test this one with dtest, but I'll need to write a dedicated test for this case (or multiple of them)

@fruch fruch merged commit 28a95c0 into scylladb:master May 9, 2024
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

usercert and userkey are loaded even if empty (None)
2 participants