Skip to content

Commit 71aa64a

Browse files
zeripathajgon
andauthored
fix broken insecureskipverify handling in rediss connection uris (#20967) (#21053)
Backport #20967 Currently, it's impossible to connect to self-signed TLS encrypted redis instances. The problem lies in inproper error handling, when building redis tls options - only invalid booleans are allowed to be used in `tlsConfig` builder. The problem is, when `strconv.ParseBool(...)` returns error, it always defaults to false - meaning it's impossible to set `tlsOptions.InsecureSkipVerify` to true. Fixes #19213 Co-authored-by: Igor Rzegocki <ajgon@users.noreply.github.com>
1 parent 3aba72c commit 71aa64a

File tree

2 files changed

+20
-2
lines changed

2 files changed

+20
-2
lines changed

modules/nosql/manager_redis.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -245,7 +245,7 @@ func getRedisTLSOptions(uri *url.URL) *tls.Config {
245245

246246
if len(skipverify) > 0 {
247247
skipverify, err := strconv.ParseBool(skipverify)
248-
if err != nil {
248+
if err == nil {
249249
tlsConfig.InsecureSkipVerify = skipverify
250250
}
251251
}
@@ -254,7 +254,7 @@ func getRedisTLSOptions(uri *url.URL) *tls.Config {
254254

255255
if len(insecureskipverify) > 0 {
256256
insecureskipverify, err := strconv.ParseBool(insecureskipverify)
257-
if err != nil {
257+
if err == nil {
258258
tlsConfig.InsecureSkipVerify = insecureskipverify
259259
}
260260
}

modules/nosql/manager_redis_test.go

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,24 @@ func TestRedisPasswordOpt(t *testing.T) {
2727
}
2828
}
2929

30+
func TestSkipVerifyOpt(t *testing.T) {
31+
uri, _ := url.Parse("rediss://myredis/0?skipverify=true")
32+
tlsConfig := getRedisTLSOptions(uri)
33+
34+
if !tlsConfig.InsecureSkipVerify {
35+
t.Fail()
36+
}
37+
}
38+
39+
func TestInsecureSkipVerifyOpt(t *testing.T) {
40+
uri, _ := url.Parse("rediss://myredis/0?insecureskipverify=true")
41+
tlsConfig := getRedisTLSOptions(uri)
42+
43+
if !tlsConfig.InsecureSkipVerify {
44+
t.Fail()
45+
}
46+
}
47+
3048
func TestRedisSentinelUsernameOpt(t *testing.T) {
3149
uri, _ := url.Parse("redis+sentinel://redis:password@myredis/0?sentinelusername=suser&sentinelpassword=spass")
3250
opts := getRedisOptions(uri).Failover()

0 commit comments

Comments
 (0)