Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

WIP: add hostname verification to pg8000 #374

Closed
wants to merge 3 commits into from
Closed

WIP: add hostname verification to pg8000 #374

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
7f16d87
feat: add hostname verification to pg8000
jackwotherspoon Sep 13, 2024
c494807
chore: remove stripping of dns name in client
jackwotherspoon Sep 13, 2024
7552597
chore: strip trailing dot for asyncpg
jackwotherspoon Sep 13, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion google/cloud/alloydb/connector/asyncpg.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,8 @@ async def connect(
raise ImportError(
'Unable to import module "asyncpg." Please install and try again.'
)
# no good way to set the server_name for asyncpg, so only use verify-ca
ctx.check_hostname = False
user = kwargs.pop("user")
db = kwargs.pop("db")
passwd = kwargs.pop("password")
Expand All @@ -55,7 +57,7 @@ async def connect(
user=user,
database=db,
password=passwd,
host=ip_address,
host=ip_address.rstrip("."),
port=SERVER_PROXY_PORT,
ssl=ctx,
direct_tls=True,
Expand Down
7 changes: 1 addition & 6 deletions google/cloud/alloydb/connector/client.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -127,15 +127,10 @@ async def _get_metadata(
resp = await self._client.get(url, headers=headers, raise_for_status=True)
resp_dict = await resp.json()

# Remove trailing period from PSC DNS name.
psc_dns = resp_dict.get("pscDnsName")
if psc_dns:
psc_dns = psc_dns.rstrip(".")

return {
"PRIVATE": resp_dict.get("ipAddress"),
"PUBLIC": resp_dict.get("publicIpAddress"),
"PSC": psc_dns,
"PSC": resp_dict.get("pscDnsName"),
}

async def _get_client_certificate(
Expand Down
3 changes: 0 additions & 3 deletions google/cloud/alloydb/connector/connection_info.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,9 +58,6 @@ async def create_ssl_context(self) -> ssl.SSLContext:

# create TLS context
context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
# TODO: Set check_hostname to True to verify the identity in the
# certificate once PSC DNS is populated in all existing clusters.
context.check_hostname = False
# force TLSv1.3
context.minimum_version = ssl.TLSVersion.TLSv1_3

Expand Down
2 changes: 1 addition & 1 deletion google/cloud/alloydb/connector/connector.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -264,7 +264,7 @@ def metadata_exchange(
"""
# Create socket and wrap with SSL/TLS context
sock = ctx.wrap_socket(
socket.create_connection((ip_address, SERVER_PROXY_PORT)),
socket.create_connection((ip_address.rstrip("."), SERVER_PROXY_PORT)),
server_hostname=ip_address,
)
# set auth type for metadata exchange
Expand Down
Loading