Add curlpp::Options::SslVerifyHost(0L) for ignore_cert_check flag #95
Conversation
I meant I built from source using the instructions in the readme. Running on a stock Ubuntu 20.04 distro with CMake 3.22.1. Set environment vars as such: I don't have the exact output in front of me at the moment, but it did throw a runtime error from tests/tests.cc#L119 (bad response). The status code was I tested my configuration with MinIO's CLI tool |
|
It appears by default the MinIO operator deploys tenants with only HTTPS/SSL (443) ports exposed as services in the cluster. It is a unique situation of untrusted CA and host but needing to force SSL despite that. This is all on a private cluster with no services forwarded out of a closed network (and it's all for running some internal benchmarks and comparisons). |
|
@TorrentialFire I ran minio server with self-signed certificate like below $ ./minio server ~/tmp/d{1..4}
Formatting 1st pool, 1 set(s), 4 drives per set.
WARNING: Host local has more than 2 drives of set. A host failure will result in data becoming unavailable.
MinIO Object Storage Server
Copyright: 2015-2023 MinIO, Inc.
License: GNU AGPLv3 <https://www.gnu.org/licenses/agpl-3.0.html>
Version: DEVELOPMENT.2023-10-06T02-54-49Z (go1.21.1 linux/amd64)
Status: 4 Online, 0 Offline.
S3-API: https://192.168.86.35:9000 https://192.168.124.1:9000 https://192.168.130.1:9000 https://127.0.0.1:9000
RootUser: minio
RootPass: minio123
Console: https://192.168.86.35:46405 https://192.168.124.1:46405 https://192.168.130.1:46405 https://127.0.0.1:46405
RootUser: minio
RootPass: minio123
Command-line: https://min.io/docs/minio/linux/reference/minio-mc.html#quickstart
$ mc alias set 'myminio' 'https://192.168.86.35:9000' 'minio' 'minio123'
Documentation: https://min.io/docs/minio/linux/index.htmland ran $ SERVER_ENDPOINT=localhost:9000 ACCESS_KEY=minio SECRET_KEY=minio123 ENABLE_HTTPS=1 IGNORE_CERT_CHECK=1 ./build/tests/tests
MakeBucket()
RemoveBucket()
BucketExists()
ListBuckets()
StatObject()
RemoveObject()
DownloadObject()
GetObject()
ListObjects()
ListObjects() 1010 objects
PutObject()
CopyObject()
UploadObject()
RemoveObjects()
SelectObjectContent()
ListenBucketNotification()Wonder why it is failing for you. |
|
Can you dump the certificate information for your minio instance? I am interested in CN, alternative names, etc. I will compare it with my test setup tomorrow and see what is different. I'd guess the issue is almost certainly a lack of domain name or IP address in my certificate (therefore libcurl can't verify the hostname, requiring this change for things to work). |
|
I did not modify the MinIO operator, tenant, or create custom CA/certs for my cluster. So, this seems like an issue out-of-the-box. |
If required information is missing, it is not |
|
In Kubernetes we sign the certificates for multiple SANs, such as:
so even if the name is being checked, as long as you came through any of these you should be fine, but I think what you want is to access the tenant via a different name (ie: localhost) and not have it verify the name right @TorrentialFire ? Here's a sample cert for a tenant called |
|
@dvaldivia correct, I am accessing the service from just outside of the cluster, the host is running a set of VMs on a libvirt virtual switch. I reach the service at the IP address of one of the cluster nodes. I disagree with @balamurugana. The lack of proper ingress and ssl termination is an issue with a cert with matching subject or SAN but in the insecure case I think this is a minio-cpp issue because the user doesn't care of the hostname matches. The flag is IGNORE_CERT_CHECK, but because CURLOPT_SSL_VERIFYHOST defaults to As a user, if I'm asking to use SSL without verifying the cert, I accept the consequences. If I decide I want the full protection of SSL with trusted CA and proper hostname/SAN verification, I'll cross that bridge. The client in minio-cpp should allow the insecure case and enforce the secure case based on IGNORE_CERT_CHECK. It currently does not. |
|
For reference, here is the certificate info for my setup. Kubernetes, exposed services: Output: As previously mentioned, I make all my requests from the machine which is hosting a set of guest VMs on a virtual switch. One of the nodes on the cluster has an IP of Certificate info: Output: Neither the CN or the SAN's would be available outside of the cluster. This is the default configuration created by the MinIO operator. I could deploy my |
|
I briefly mentioned in one of my earlier responses that the MinIO CLI We could look into potential ways of determining if |
balamurugana
changed the title
In addition to
CURLOPT_SSL_VERIFYPEER, libcurl also hasCURLOPT_SSL_VERIFYHOSTwhich when set to2Lstrictly checks the hostname provided against hostnames in the site's certificate. When running in insecure mode, this value should be set to0Lto allow a connection to a host not listed in the certificate (which is the case in some test MinIO deployment configurations).I have a MinIO tenant deployed via the MinIO operator on a RKE2-based k8s deployment that I use for development and testing purposes. This configuration uses the default CA generated for the cluster, which is not a trusted CA. The executable generated by the build for
src/tests/tests.ccfails on the first request because curlpp (libcurl) cannot verify the hostname of MinIO service (it is just an IP address).This fix explicitly sets the value of
CURLOPT_SSL_VERIFYHOSTin both cases (secure/insecure). In the secure case, it is simply set to what is already the default value. Feel free to remove that line if you do not prefer explicit configuration.References:
https://curl.se/libcurl/c/CURLOPT_SSL_VERIFYPEER.html
https://curl.se/libcurl/c/CURLOPT_SSL_VERIFYHOST.html