allow insecure cloud connections (#19736)
Costa Tsaousis committed
Feb 28, 2025 at 13:55 UTC
a8444c221e0931f63451bb518d601f678f3424d6
2 files changed
+10
-13
src/aclk/aclk.c
+4
-7
@@ -605,11 +605,6 @@ const char *aclk_cloud_base_url = NULL;
605
* >0 - exit_initiated
606
*/
607
#define CLOUD_BASE_URL_READ_RETRY 30
608
-#ifdef ACLK_SSL_ALLOW_SELF_SIGNED
609
-#define ACLK_SSL_FLAGS MQTT_WSS_SSL_ALLOW_SELF_SIGNED
610
-#else
611
-#define ACLK_SSL_FLAGS MQTT_WSS_SSL_CERT_CHECK_FULL
612
-#endif
608
static int aclk_attempt_to_connect(mqtt_wss_client client)
609
{
610
https_client_resp_t rc;
@@ -743,11 +738,13 @@ static int aclk_attempt_to_connect(mqtt_wss_client client)
738
739
mqtt_conn_params.will_msg = aclk_generate_lwt(&mqtt_conn_params.will_msg_len);
740
741
+ int ssl_flags = cloud_config_insecure_get() ? MQTT_WSS_SSL_ALLOW_SELF_SIGNED : MQTT_WSS_SSL_CERT_CHECK_FULL;
742
+
743
#ifdef ACLK_DISABLE_CHALLENGE
747
- int mqtt_rc = mqtt_wss_connect(client, base_url.host, base_url.port, &mqtt_conn_params, ACLK_SSL_FLAGS, &proxy_conf);
744
+ int mqtt_rc = mqtt_wss_connect(client, base_url.host, base_url.port, &mqtt_conn_params, ssl_flags, &proxy_conf);
745
url_t_destroy(&base_url);
746
#else
750
- int mqtt_rc = mqtt_wss_connect(client, mqtt_url.host, mqtt_url.port, &mqtt_conn_params, ACLK_SSL_FLAGS, &proxy_conf, &fallback_ipv4);
747
+ int mqtt_rc = mqtt_wss_connect(client, mqtt_url.host, mqtt_url.port, &mqtt_conn_params, ssl_flags, &proxy_conf, &fallback_ipv4);
748
url_t_destroy(&mqtt_url);
749
750
freez((char*)mqtt_conn_params.clientid);
src/aclk/https_client.c
+6
-6
@@ -738,13 +738,13 @@ static int cert_verify_callback(int preverify_ok, X509_STORE_CTX *ctx)
738
free(err_str);
739
}
740
741
-#ifdef ACLK_SSL_ALLOW_SELF_SIGNED
742
- if (!preverify_ok && err == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT)
743
- {
744
- preverify_ok = 1;
745
- netdata_log_error("ACLK: Self Signed Certificate Accepted as the agent was built with ACLK_SSL_ALLOW_SELF_SIGNED");
741
+ if(cloud_config_insecure_get()) {
742
+ if (!preverify_ok && err == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT) {
743
+ preverify_ok = 1;
744
+ netdata_log_error(
745
+ "ACLK: Self Signed Certificate Accepted as the agent was configured with ACLK_SSL_ALLOW_SELF_SIGNED");
746
+ }
747
}
747
-#endif
748
749
return preverify_ok;
750
}