[incubator-servicecomb-service-center] branch master updated: Bug fix: rest client still verify peer host when verifyPeer flag set false (#441)

[li...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

littlecui pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/incubator-servicecomb-service-center.git


The following commit(s) were added to refs/heads/master by this push:
     new b6385a0  Bug fix: rest client still verify peer host when verifyPeer flag set false (#441)
b6385a0 is described below

commit b6385a060d661b7c5410de3eeed4ccad320e0bcf
Author: little-cui <su...@qq.com>
AuthorDate: Sat Sep 15 15:19:25 2018 +0800

    Bug fix: rest client still verify peer host when verifyPeer flag set false (#441)
---
 pkg/tlsutil/tlsutil.go      |  2 +-
 pkg/tlsutil/tlsutil_test.go | 35 +++++++++++++++++++++++++++++++++++
 scctl/pkg/cmd/cmd.go        | 21 ++++++++-------------
 3 files changed, 44 insertions(+), 14 deletions(-)

diff --git a/pkg/tlsutil/tlsutil.go b/pkg/tlsutil/tlsutil.go
index fcf444d..b520e2c 100644
--- a/pkg/tlsutil/tlsutil.go
+++ b/pkg/tlsutil/tlsutil.go
@@ -152,7 +152,7 @@ func GetClientTLSConfig(opts ...SSLConfigOption) (tlsConfig *tls.Config, err err
 		RootCAs:            pool,
 		Certificates:       certs,
 		CipherSuites:       cfg.CipherSuites,
-		InsecureSkipVerify: !cfg.VerifyHostName,
+		InsecureSkipVerify: !cfg.VerifyPeer || !cfg.VerifyHostName,
 		MinVersion:         cfg.MinVersion,
 		MaxVersion:         cfg.MaxVersion,
 	}
diff --git a/pkg/tlsutil/tlsutil_test.go b/pkg/tlsutil/tlsutil_test.go
index eaa8f72..a1c88a6 100644
--- a/pkg/tlsutil/tlsutil_test.go
+++ b/pkg/tlsutil/tlsutil_test.go
@@ -112,4 +112,39 @@ func TestGetClientTLSConfig(t *testing.T) {
 	if clientTLSConfig.InsecureSkipVerify != true {
 		t.Fatalf("GetClientTLSConfig failed")
 	}
+
+	// verify peer and peer host
+	opts = append(opts,
+		WithVerifyPeer(false),
+		WithVerifyHostName(true),
+	)
+	clientTLSConfig, err = GetClientTLSConfig(opts...)
+	if err != nil {
+		t.Fatalf("GetClientTLSConfig failed")
+	}
+	if clientTLSConfig.RootCAs != nil || !clientTLSConfig.InsecureSkipVerify {
+		t.Fatalf("GetClientTLSConfig failed")
+	}
+	opts = append(opts,
+		WithVerifyPeer(true),
+		WithVerifyHostName(false),
+	)
+	clientTLSConfig, err = GetClientTLSConfig(opts...)
+	if err != nil {
+		t.Fatalf("GetClientTLSConfig failed")
+	}
+	if clientTLSConfig.RootCAs == nil || !clientTLSConfig.InsecureSkipVerify {
+		t.Fatalf("GetClientTLSConfig failed")
+	}
+	opts = append(opts,
+		WithVerifyPeer(true),
+		WithVerifyHostName(true),
+	)
+	clientTLSConfig, err = GetClientTLSConfig(opts...)
+	if err != nil {
+		t.Fatalf("GetClientTLSConfig failed")
+	}
+	if clientTLSConfig.RootCAs == nil || clientTLSConfig.InsecureSkipVerify {
+		t.Fatalf("GetClientTLSConfig failed")
+	}
 }
diff --git a/scctl/pkg/cmd/cmd.go b/scctl/pkg/cmd/cmd.go
index e015d3d..55e6dfc 100644
--- a/scctl/pkg/cmd/cmd.go
+++ b/scctl/pkg/cmd/cmd.go
@@ -22,7 +22,6 @@ import (
 	"github.com/apache/incubator-servicecomb-service-center/scctl/pkg/version"
 	"github.com/spf13/cobra"
 	"os"
-	"path/filepath"
 )
 
 const (
@@ -52,18 +51,14 @@ func init() {
 
 	rootCmd.PersistentFlags().BoolVarP(&sc.VerifyPeer, "peer", "p", false,
 		"verify service center certificates.")
-	rootCmd.PersistentFlags().StringVar(&sc.CertPath, "cert",
-		filepath.Join(util.GetEnvString("SSL_ROOT", "."), "server.cer"),
-		"the certificate file path to access service center, can be overrode by $SSL_ROOT/server.cer.")
-	rootCmd.PersistentFlags().StringVar(&sc.KeyPath, "key",
-		filepath.Join(util.GetEnvString("SSL_ROOT", "."), "server_key.pem"),
-		"the key file path to access service center, can be overrode by $SSL_ROOT/server_key.pem.")
-	rootCmd.PersistentFlags().StringVar(&sc.CAPath, "ca",
-		filepath.Join(util.GetEnvString("SSL_ROOT", "."), "trust.cer"),
-		"the CA file path  to access service center, can be overrode by $SSL_ROOT/trust.cer.")
-	rootCmd.PersistentFlags().StringVar(&sc.KeyPassPath, "pass-file",
-		filepath.Join(util.GetEnvString("SSL_ROOT", "."), "cert_pwd"),
-		"the passphase file path to decrypt key file, can be overrode by $SSL_ROOT/cert_pwd.")
+	rootCmd.PersistentFlags().StringVar(&sc.CertPath, "cert", "",
+		"the certificate file path to access service center.")
+	rootCmd.PersistentFlags().StringVar(&sc.KeyPath, "key", "",
+		"the key file path to access service center.")
+	rootCmd.PersistentFlags().StringVar(&sc.CAPath, "ca", "",
+		"the CA file path  to access service center.")
+	rootCmd.PersistentFlags().StringVar(&sc.KeyPassPath, "pass-file", "",
+		"the passphase file path to decrypt key file.")
 	rootCmd.PersistentFlags().StringVar(&sc.KeyPass, "pass", "",
 		"the passphase string to decrypt key file.")
 }