Skip to content

Commit 3f9c68f

Browse files
author
Dean Troyer
committed
Add options to support TLS certificate verification
Add --os-cacert and --verify|--insecure options using the same sematics as the other project CLIs. --verify is included for completeness. Bug: 1236608 Change-Id: I8a116d790db5aa4cb17a2207efedce7cb229eba3
1 parent bca4cf9 commit 3f9c68f

7 files changed

Lines changed: 53 additions & 7 deletions

File tree

‎openstackclient/common/clientmanager.py‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ class ClientManager(object):
5050

5151
def __init__(self, token=None, url=None, auth_url=None, project_name=None,
5252
project_id=None, username=None, password=None,
53-
region_name=None, api_version=None):
53+
region_name=None, verify=True, api_version=None):
5454
self._token = token
5555
self._url = url
5656
self._auth_url = auth_url
@@ -62,6 +62,16 @@ def __init__(self, token=None, url=None, auth_url=None, project_name=None,
6262
self._api_version = api_version
6363
self._service_catalog = None
6464

65+
# verify is the Requests-compatible form
66+
self._verify = verify
67+
# also store in the form used by the legacy client libs
68+
self._cacert = None
69+
if verify is True or verify is False:
70+
self._insecure = not verify
71+
else:
72+
self._cacert = verify
73+
self._insecure = True
74+
6575
self.auth_ref = None
6676

6777
if not self._url:

‎openstackclient/common/restapi.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@ def __init__(
5353
os_auth=None,
5454
user_agent=USER_AGENT,
5555
debug=None,
56+
verify=True,
5657
**kwargs
5758
):
5859
self.set_auth(os_auth)

‎openstackclient/compute/client.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -38,8 +38,8 @@ def make_client(instance):
3838
api_key=instance._password,
3939
project_id=instance._project_name,
4040
auth_url=instance._auth_url,
41-
# FIXME(dhellmann): add constructor argument for this
42-
insecure=False,
41+
cacert=instance._cacert,
42+
insecure=instance._insecure,
4343
region_name=instance._region_name,
4444
# FIXME(dhellmann): get endpoint_type from option?
4545
endpoint_type='publicURL',

‎openstackclient/identity/client.py‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,10 @@ def make_client(instance):
4747
tenant_name=instance._project_name,
4848
tenant_id=instance._project_id,
4949
auth_url=instance._auth_url,
50-
region_name=instance._region_name)
50+
region_name=instance._region_name,
51+
cacert=instance._cacert,
52+
insecure=instance._insecure,
53+
)
5154
instance.auth_ref = client.auth_ref
5255
return client
5356

‎openstackclient/image/client.py‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,12 @@ def make_client(instance):
4040
if not instance._url:
4141
instance._url = instance.get_endpoint_for_service_type(API_NAME)
4242

43-
return image_client(instance._url, token=instance._token)
43+
return image_client(
44+
instance._url,
45+
token=instance._token,
46+
cacert=instance._cacert,
47+
insecure=instance._insecure,
48+
)
4449

4550

4651
# NOTE(dtroyer): glanceclient.v1.image.ImageManager() doesn't have a find()

‎openstackclient/shell.py‎

Lines changed: 27 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,9 @@ def __init__(self):
7979
# password flow auth
8080
self.auth_client = None
8181

82+
# Assume TLS host certificate verification is enabled
83+
self.verify = True
84+
8285
# NOTE(dtroyer): This hack changes the help action that Cliff
8386
# automatically adds to the parser so we can defer
8487
# its execution until after the api-versioned commands
@@ -158,6 +161,22 @@ def build_option_parser(self, description, version):
158161
metavar='<auth-region-name>',
159162
default=env('OS_REGION_NAME'),
160163
help='Authentication region name (Env: OS_REGION_NAME)')
164+
parser.add_argument(
165+
'--os-cacert',
166+
metavar='<ca-bundle-file>',
167+
default=env('OS_CACERT'),
168+
help='CA certificate bundle file (Env: OS_CACERT)')
169+
verify_group = parser.add_mutually_exclusive_group()
170+
verify_group.add_argument(
171+
'--verify',
172+
action='store_true',
173+
help='Verify server certificate (default)',
174+
)
175+
verify_group.add_argument(
176+
'--insecure',
177+
action='store_true',
178+
help='Disable server certificate verification',
179+
)
161180
parser.add_argument(
162181
'--os-default-domain',
163182
metavar='<auth-domain>',
@@ -299,7 +318,9 @@ def authenticate_user(self):
299318
username=self.options.os_username,
300319
password=self.options.os_password,
301320
region_name=self.options.os_region_name,
302-
api_version=self.api_version)
321+
verify=self.verify,
322+
api_version=self.api_version,
323+
)
303324
return
304325

305326
def init_keyring_backend(self):
@@ -387,7 +408,11 @@ def initialize_app(self, argv):
387408
self.DeferredHelpAction(self.parser, self.parser, None, None)
388409

389410
# Set up common client session
390-
self.restapi = restapi.RESTApi()
411+
if self.options.os_cacert:
412+
self.verify = self.options.os_cacert
413+
else:
414+
self.verify = not self.options.insecure
415+
self.restapi = restapi.RESTApi(verify=self.verify)
391416

392417
def prepare_to_run_command(self, cmd):
393418
"""Set up auth and API versions"""

‎openstackclient/volume/client.py‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,8 @@ def make_client(instance):
4040
api_key=instance._password,
4141
project_id=instance._project_name,
4242
auth_url=instance._auth_url,
43+
cacert=instance._cacert,
44+
insecure=instance._insecure,
4345
)
4446

4547
return client

0 commit comments

Comments
 (0)