NEW: TLS client and CA certificate support
- Added tls_ca_file, tls_cert_file and tls_key_file options for UrlService
Andrey Galkin committed
May 3, 2018 at 00:14 UTC
60e74d42fbda72222402d3f2f9a04a3eb0d1e2ca
1 file changed
+17
-2
python.d/python_modules/bases/FrameworkServices/UrlService.py
+17
-2
@@ -25,6 +25,9 @@ class UrlService(SimpleService):
25
self.header = self.configuration.get('header')
26
self.request_timeout = self.configuration.get('timeout', 1)
27
self.tls_verify = self.configuration.get('tls_verify')
28
+ self.tls_ca_file = self.configuration.get('tls_ca_file')
29
+ self.tls_key_file = self.configuration.get('tls_key_file')
30
+ self.tls_cert_file = self.configuration.get('tls_cert_file')
31
self._manager = None
32
33
def __make_headers(self, **header_kw):
@@ -61,10 +64,22 @@ class UrlService(SimpleService):
64
else:
65
manager = urllib3.PoolManager
66
params = dict(headers=header)
67
+ tls_cert_file = self.tls_cert_file
68
+ if tls_cert_file:
69
+ params['cert_file'] = tls_cert_file
70
+ # NOTE: key_file is useless without cert_file, but
71
+ # cert_file may include the key as well.
72
+ tls_key_file = self.tls_key_file
73
+ if tls_key_file:
74
+ params['key_file'] = tls_key_file
75
+ tls_ca_file = self.tls_ca_file
76
+ if tls_ca_file:
77
+ params['ca_certs'] = tls_ca_file
78
try:
79
url = header_kw.get('url') or self.url
66
- if url.startswith('https') and not self.tls_verify:
67
- return manager(assert_hostname=False, cert_reqs='CERT_NONE', ca_certs=None, **params)
80
+ if url.startswith('https') and not self.tls_verify and not tls_ca_file:
81
+ params['ca_certs'] = None
82
+ return manager(assert_hostname=False, cert_reqs='CERT_NONE', **params)
83
return manager(**params)
84
except (urllib3.exceptions.ProxySchemeUnknown, TypeError) as error:
85
self.error('build_manager() error:', str(error))