Browse Source

[desktop] Add global ssl_validate config option

Erick Tryzelaar 10 years ago
parent
commit
8eb3249

+ 2 - 2
apps/beeswax/src/beeswax/conf.py

@@ -22,7 +22,7 @@ import beeswax.hive_site
 
 from django.utils.translation import ugettext_lazy as _t, ugettext as _
 
-from desktop.conf import default_ssl_cacerts
+from desktop.conf import default_ssl_cacerts, default_ssl_validate
 from desktop.lib.conf import ConfigSection, Config, coerce_bool
 
 from beeswax.settings import NICE_NAME
@@ -129,7 +129,7 @@ SSL = ConfigSection(
       key="validate",
       help=_t("Choose whether Hue should validate certificates received from the server."),
       type=coerce_bool,
-      default=True
+      dynamic_default=default_ssl_validate,
     )
   )
 )

+ 27 - 0
apps/beeswax/src/beeswax/tests.py

@@ -2758,3 +2758,30 @@ def test_ssl_cacerts():
     finally:
       for reset in resets:
         reset()
+
+
+def test_ssl_validate():
+  for desktop_kwargs, conf_kwargs, expected in [
+      ({'present': False}, {'present': False}, True),
+      ({'present': False}, {'data': False}, False),
+      ({'present': False}, {'data': True}, True),
+
+      ({'data': False}, {'present': False}, False),
+      ({'data': False}, {'data': False}, False),
+      ({'data': False}, {'data': True}, True),
+
+      ({'data': True}, {'present': False}, True),
+      ({'data': True}, {'data': False}, False),
+      ({'data': True}, {'data': True}, True),
+      ]:
+    resets = [
+      desktop_conf.SSL_VALIDATE.set_for_testing(**desktop_kwargs),
+      conf.SSL.VALIDATE.set_for_testing(**conf_kwargs),
+    ]
+
+    try:
+      assert_equal(conf.SSL.VALIDATE.get(), expected,
+          'desktop:%s conf:%s expected:%s got:%s' % (desktop_kwargs, conf_kwargs, expected, conf.SSL.VALIDATE.get()))
+    finally:
+      for reset in resets:
+        reset()

+ 2 - 2
apps/impala/src/impala/conf.py

@@ -20,7 +20,7 @@ import sys
 import socket
 
 from django.utils.translation import ugettext_lazy as _t, ugettext as _
-from desktop.conf import default_ssl_cacerts
+from desktop.conf import default_ssl_cacerts, default_ssl_validate
 from desktop.lib.conf import ConfigSection, Config, coerce_bool
 
 from impala.settings import NICE_NAME
@@ -117,7 +117,7 @@ SSL = ConfigSection(
       key="validate",
       help=_t("Choose whether Hue should validate certificates received from the server."),
       type=coerce_bool,
-      default=True
+      dynamic_default=default_ssl_validate,
     )
   )
 )

+ 27 - 0
apps/impala/src/impala/tests.py

@@ -252,3 +252,30 @@ def test_ssl_cacerts():
     finally:
       for reset in resets:
         reset()
+
+
+def test_ssl_validate():
+  for desktop_kwargs, conf_kwargs, expected in [
+      ({'present': False}, {'present': False}, True),
+      ({'present': False}, {'data': False}, False),
+      ({'present': False}, {'data': True}, True),
+
+      ({'data': False}, {'present': False}, False),
+      ({'data': False}, {'data': False}, False),
+      ({'data': False}, {'data': True}, True),
+
+      ({'data': True}, {'present': False}, True),
+      ({'data': True}, {'data': False}, False),
+      ({'data': True}, {'data': True}, True),
+      ]:
+    resets = [
+      desktop_conf.SSL_VALIDATE.set_for_testing(**desktop_kwargs),
+      conf.SSL.VALIDATE.set_for_testing(**conf_kwargs),
+    ]
+
+    try:
+      assert_equal(conf.SSL.VALIDATE.get(), expected,
+          'desktop:%s conf:%s expected:%s got:%s' % (desktop_kwargs, conf_kwargs, expected, conf.SSL.VALIDATE.get()))
+    finally:
+      for reset in resets:
+        reset()

+ 3 - 0
desktop/conf.dist/hue.ini

@@ -85,6 +85,9 @@
   # Path to default Certificate Authority certificates.
   ## ssl_cacerts=/etc/hue/cacerts.pem
 
+  # Choose whether Hue should validate certificates received from the server.
+  ## validate=true
+
   # LDAP username and password of the hue user used for LDAP authentications.
   # Set it to use LDAP Authentication with HiveServer2 and Impala.
   ## ldap_username=hue

+ 3 - 0
desktop/conf/pseudo-distributed.ini.tmpl

@@ -91,6 +91,9 @@
   # Path to default Certificate Authority certificates.
   ## ssl_cacerts=/etc/hue/cacerts.pem
 
+  # Choose whether Hue should validate certificates received from the server.
+  ## validate=true
+
   # LDAP username and password of the hue user used for LDAP authentications.
   # Set it to use LDAP Authentication with HiveServer2 and Impala.
   ## ldap_username=hue

+ 11 - 0
desktop/core/src/desktop/conf.py

@@ -115,6 +115,12 @@ SSL_CACERTS = Config(
   type=str,
   default='/etc/hue/cacerts.pem')
 
+SSL_VALIDATE = Config(
+  key="ssl_validate",
+  help=_('Choose whether Hue should validate certificates received from the server.'),
+  type=coerce_bool,
+  default=True)
+
 LDAP_PASSWORD = Config(
   key="ldap_password",
   help=_("LDAP password of the hue user used for LDAP authentications. For example for LDAP Authentication with HiveServer2/Impala."),
@@ -266,6 +272,11 @@ def default_ssl_cacerts():
   return SSL_CACERTS.get()
 
 
+def default_ssl_validate():
+  """Choose whether Hue should validate certificates received from the server."""
+  return SSL_VALIDATE.get()
+
+
 SMTP = ConfigSection(
   key='smtp',
   help=_('Configuration options for connecting to an external SMTP server.'),