|
@@ -40,14 +40,18 @@ def get_tls_settings():
|
|
|
"""
|
|
"""
|
|
|
from desktop import conf
|
|
from desktop import conf
|
|
|
|
|
|
|
|
|
|
+ # Check for both TLS 1.3 and TLS 1.2
|
|
|
|
|
+ tls13_enabled = conf.SSL_TLS13_ENABLED.get()
|
|
|
|
|
+ tls12_enabled = conf.SSL_TLS12_ENABLED.get()
|
|
|
|
|
+
|
|
|
|
|
+ if not tls13_enabled and not tls12_enabled:
|
|
|
|
|
+ LOG.warning("TLS 1.3 and TLS 1.2 are disabled, returning empty TLS settings")
|
|
|
|
|
+ return None
|
|
|
|
|
+
|
|
|
tls_settings = {}
|
|
tls_settings = {}
|
|
|
try:
|
|
try:
|
|
|
import ssl
|
|
import ssl
|
|
|
|
|
|
|
|
- # Check for both TLS 1.3 and TLS 1.2
|
|
|
|
|
- tls13_enabled = conf.SSL_TLS13_ENABLED.get()
|
|
|
|
|
- tls12_enabled = conf.SSL_TLS12_ENABLED.get()
|
|
|
|
|
-
|
|
|
|
|
# Set default values for minimum and maximum versions
|
|
# Set default values for minimum and maximum versions
|
|
|
min_version = "TLSv1.2"
|
|
min_version = "TLSv1.2"
|
|
|
max_version = "TLSv1.2"
|
|
max_version = "TLSv1.2"
|
|
@@ -91,12 +95,14 @@ def create_ssl_context(validate=True, ca_certs=None, keyfile=None, certfile=None
|
|
|
Returns:
|
|
Returns:
|
|
|
ssl.SSLContext: Configured SSL context or None if creation failed
|
|
ssl.SSLContext: Configured SSL context or None if creation failed
|
|
|
"""
|
|
"""
|
|
|
|
|
+ # Get TLS settings from centralized configuration
|
|
|
|
|
+ tls_settings = get_tls_settings()
|
|
|
|
|
+ if not tls_settings:
|
|
|
|
|
+ return None
|
|
|
|
|
+
|
|
|
try:
|
|
try:
|
|
|
import ssl
|
|
import ssl
|
|
|
|
|
|
|
|
- # Get TLS settings from centralized configuration
|
|
|
|
|
- tls_settings = get_tls_settings()
|
|
|
|
|
-
|
|
|
|
|
# Check for errors in TLS settings
|
|
# Check for errors in TLS settings
|
|
|
if "error" in tls_settings:
|
|
if "error" in tls_settings:
|
|
|
LOG.error(f"TLS configuration error: {tls_settings['error']}")
|
|
LOG.error(f"TLS configuration error: {tls_settings['error']}")
|
|
@@ -234,6 +240,8 @@ def create_thrift_ssl_context(validate=True, ca_certs=None, keyfile=None, certfi
|
|
|
ssl.SSLContext configured for Thrift connections or None if creation failed
|
|
ssl.SSLContext configured for Thrift connections or None if creation failed
|
|
|
"""
|
|
"""
|
|
|
context = create_ssl_context(validate, ca_certs, keyfile, certfile)
|
|
context = create_ssl_context(validate, ca_certs, keyfile, certfile)
|
|
|
|
|
+ if context is None:
|
|
|
|
|
+ return None
|
|
|
|
|
|
|
|
if context and validate:
|
|
if context and validate:
|
|
|
# Thrift handles hostname validation separately
|
|
# Thrift handles hostname validation separately
|
|
@@ -251,7 +259,12 @@ def create_http_ssl_context():
|
|
|
"""
|
|
"""
|
|
|
from desktop import conf
|
|
from desktop import conf
|
|
|
|
|
|
|
|
- return create_ssl_context(
|
|
|
|
|
|
|
+ context = create_ssl_context(
|
|
|
validate=conf.SSL_VALIDATE.get(),
|
|
validate=conf.SSL_VALIDATE.get(),
|
|
|
ca_certs=conf.SSL_CACERTS.get() if conf.SSL_VALIDATE.get() else None
|
|
ca_certs=conf.SSL_CACERTS.get() if conf.SSL_VALIDATE.get() else None
|
|
|
)
|
|
)
|
|
|
|
|
+ if context is None:
|
|
|
|
|
+ LOG.warning("HTTP SSL context is not available, returning None")
|
|
|
|
|
+ return None
|
|
|
|
|
+
|
|
|
|
|
+ return context
|