mirror of
https://github.com/hanzoai/datastore.git
synced 2026-09-26 13:55:07 +00:00
Antonio AndelicandClaude Opus 4.8
a7b006067a
Keeper's internal Raft (`NuRaft`) always verified peer certificates on the client side regardless of `openSSL.client.verificationMode`. `asio_rpc_client` calls `set_verify_mode` with `verify_peer` (a per-connection `SSL_set_verify` override) unless `asio_service::options::skip_verification_` is set, and ClickHouse never set it. So `verificationMode` set to `none` had no effect on the Raft layer: users could not disable peer verification and kept getting `tlsv1 alert unknown ca` even with `none` configured. Wire `skip_verification_` from the client verification mode in `setSSLParams`: Raft peer verification is now disabled only when `openSSL.client.verificationMode` is explicitly set to `none`. An absent key keeps the previous secure-by-default behavior (verify), and any other mode keeps verifying. A warning is logged when verification is disabled. The server side already honors its `verificationMode` via the `SSL_CTX` and is unchanged. Update `test_keeper_internal_secure`: the existing secure configs used client `verificationMode` `none` (which only verified by accident), so switch them to `relaxed` to keep exercising real verification, and add cases proving an explicit `none` skips a wrong CA while `relaxed` still rejects it. Closes: https://github.com/ClickHouse/ClickHouse/issues/76210 Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
23 lines
1.3 KiB
Plaintext
23 lines
1.3 KiB
Plaintext
-----BEGIN CERTIFICATE-----
|
|
MIIDmTCCAoGgAwIBAgIUFDsqlCxc9tpTvy4hWFQFDKHFS0wwDQYJKoZIhvcNAQEL
|
|
BQAwXDELMAkGA1UEBhMCVVMxDTALBgNVBAgMBFRlc3QxDTALBgNVBAcMBFRlc3Qx
|
|
GDAWBgNVBAoMD0NsaWNrSG91c2UgVGVzdDEVMBMGA1UEAwwMVGVzdCBSb290IENB
|
|
MB4XDTI2MDEwNjE4MTc1NloXDTM2MDEwNDE4MTc1NlowXDELMAkGA1UEBhMCVVMx
|
|
DTALBgNVBAgMBFRlc3QxDTALBgNVBAcMBFRlc3QxGDAWBgNVBAoMD0NsaWNrSG91
|
|
c2UgVGVzdDEVMBMGA1UEAwwMVGVzdCBSb290IENBMIIBIjANBgkqhkiG9w0BAQEF
|
|
AAOCAQ8AMIIBCgKCAQEA2KyXpXN9zOIhL7PI6ao1e1nag/oQKrLAi2sbchpkzysK
|
|
x70b0kRy3jTRJztcVb2YYUm1sqHH65/mBp2ZxN2ObnVuTs3HvBsTXSOMeEfZcP0z
|
|
tqSdXrkOQ7LxNpO4o0+jWvmK70dIr2E02f6di1h0hHGrY4tX2lsuIydX6H7n4fgz
|
|
mf5wi/qpwptdtIh3u1LgoULYWqBlLZiD95ap1kx9Wfub8zT+a0zI1LAUUbnvN3Nm
|
|
Rf4vj5dStBqTx6xBGoYjg67YZYJP2/AyMihS8b4NnBTo7y64lTizfhYrY6azrQB3
|
|
utyE5xZrRNBeCwb/BvlkDLKCN94AMKdGQcExYLFhlwIDAQABo1MwUTAdBgNVHQ4E
|
|
FgQUCmGhTJ/11Fna19AvOZ02wIdMQfIwHwYDVR0jBBgwFoAUCmGhTJ/11Fna19Av
|
|
OZ02wIdMQfIwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAOblY
|
|
zG8pCUTxUIXv4okzm8zpNVhJOLSp3IPtnVEDfV7adHPo9MXbdXWIxcufOIVBUStu
|
|
oqtg6fjMp8FnFJKFpy3/xq60m7WDaRBnsffbFfvA7s9F7WmHW4+mjgMhUc865uME
|
|
aZUCPi7DODbH8QElvhlAXv5uxYGwIogBpIXriD1rI7peC89s92/GYRqSs2JOA4N5
|
|
/4C24MlwGBkUoGjOo4T3zfsGCnFBzW3GtfgoFcoPpT1qoHgqFq4sGNZ5XNXqPfsb
|
|
1vD2WPm58ssGmr0+YoSr3h/fIQ+J7MtwQALEufdxeD/VYxFIpgRGIFUIiPX3QNRX
|
|
FTke2R949wtdOa4BkQ==
|
|
-----END CERTIFICATE-----
|