Allow HTTPS requests to use tls_ciphers
#20179
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Codecov ReportAttention: Patch coverage is
Additional details and impacted files
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
dkirov-dd
force-pushed
the
dk/AGENT-12451/tls-ciphers
branch
2 times, most recently
from
0eeb208 to
63b5b09
Compare
datadog-agent-integrations-bot
bot
added
dev_package
integration/envoy
integration/haproxy
integration/kube_dns
integration/kube_proxy
integration/kubelet
integration/powerdns_recursor
integration/spark
integration/vsphere
integration/vault
integration/kube_controller_manager
integration/twistlock
integration/kube_scheduler
integration/kube_metrics_server
integration/amazon_msk
integration/voltdb
integration/citrix_hypervisor
integration/arangodb
integration/cert_manager
integration/vllm
integration/airflow
integration/tls
labels
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| request_overrides = {} | ||
| if new_options.get('verify') != self.options['verify']: | ||
| if new_options.get('verify') is True: |
Check failure
Code scanning / CodeQL
Use of insecure SSL/TLS version High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 1 day ago
To address the issue, the create_ssl_context function should be updated (or its behavior overridden) to explicitly enforce the use of secure protocols, such as TLSv1.2 or higher. This can be achieved by setting the minimum_version attribute of the SSLContext object to ssl.TLSVersion.TLSv1_2. Additionally, the options attribute can be configured to disable insecure protocols like TLSv1 and TLSv1.1.
The changes should be made in the create_ssl_context function, which is referenced on line 509. If this function is defined elsewhere in the codebase, it should be updated accordingly. If it is imported from an external library, a wrapper function can be created to enforce secure protocols.
Suggested changeset
1
datadog_checks_base/datadog_checks/base/utils/http.py
| @@ -31,3 +31,3 @@ | ||
| from .time import get_timestamp | ||
| from .tls import SUPPORTED_PROTOCOL_VERSIONS, TlsConfig, create_ssl_context | ||
| from .tls import SUPPORTED_PROTOCOL_VERSIONS, TlsConfig | ||
|
|
||
| @@ -508,3 +508,3 @@ | ||
| try: | ||
| context = create_ssl_context(ChainMap({'tls_verify': False}, self.tls_config)) | ||
| context = self._create_secure_ssl_context(ChainMap({'tls_verify': False}, self.tls_config)) | ||
|
|
||
| @@ -526,2 +526,12 @@ | ||
|
|
||
| def _create_secure_ssl_context(self, tls_config): | ||
| import ssl | ||
| context = ssl.create_default_context() | ||
| context.minimum_version = ssl.TLSVersion.TLSv1_2 | ||
| context.options |= ssl.OP_NO_TLSv1 | ssl.OP_NO_TLSv1_1 | ||
| # Apply additional configurations from tls_config if necessary | ||
| for key, value in tls_config.items(): | ||
| setattr(context, key, value) | ||
| return context | ||
|
|
||
| def load_intermediate_certs(self, der_cert, certs): |
Copilot is powered by AI and may make mistakes. Always verify output.
Unable to commit as this autofix suggestion is now outdated
Co-authored-by: Ilia Kurenkov <ilia.kurenkov@datadoghq.com>
Co-authored-by: Ilia Kurenkov <ilia.kurenkov@datadoghq.com>
Co-authored-by: Ilia Kurenkov <ilia.kurenkov@datadoghq.com>
dkirov-dd
force-pushed
the
dk/AGENT-12451/tls-ciphers
branch
from
2ebb470 to
7e713a1
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What does this PR do?
This PR modifies the behavior of the
RequestsWrapperto make use ofrequests.Sessionfor all requests.It extends the allowed TLS ciphers to all those that are allowed by the compile-time configuration.
This was achieved using the
Sessionclass's HTTPSAdapter, which passes the customSSLContextto the underlyingurllib3functions.Note
Many unit and integration tests that were previously mocking
requests.getor otherrequestsmethods needed to be re-written with these changes in mind.N.B: These test should most likely be rewritten in a subsequent PR to use higher-level mocks. This would prevent future PRs that would change logic inside the
RequestsWrapperto have to fix hundreds of tests.Motivation
The integration config provides a
tls_ciphersparameter that was not utilized uniformly throughout HTTPS requests. Most notably, it had no effect on the requests made through the AgentCheck'shttpattribute.Allowing the modification of cipher suites is essential to support the broadest array of use cases.
For example, some users have endpoints that do not accept any of Python's ssl.SSLCipher default cipher suites, leading to these endpoints being unusable with our checks.
Important
The goal for this PR is to only extend the realm of usable endpoints for end users.
All existing interfaces, inputs, and outputs remain unchanged.
No user action is required to benefit from the improvements.
Review checklist (to be filled by reviewers)
qa/skip-qalabel if the PR doesn't need to be tested during QA.backport/<branch-name>label to the PR and it will automatically open a backport PR once this one is merged