Skip to content

Commit f31682f

Browse files
rpc: remove InsecureSkipVerify from DRPC TLS client config
`InsecureSkipVerify` disables certificate verification and introduces significant security risks. This commit removes `InsecureSkipVerify` option from the DRPC TLS client configuration. ServerName in TLS config is used to ensure the server's certificate matches the expected hostname the client is connecting to. gRPC does it here. https://github.com/grpc/grpc-go/blob/62071420ce2be9eaa916159c1d7609adf3c3aaaa/credentials/tls.go#L110-L120 Epic: CRDB-51459 Issues: #147921 Release note: none
1 parent 0e90087 commit f31682f

File tree

1 file changed

+5
-3
lines changed

1 file changed

+5
-3
lines changed

pkg/rpc/drpc.go

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -79,9 +79,11 @@ func DialDRPC(
7979
}
8080
// Clone TLS config to avoid modifying a cached TLS config.
8181
tlsConfig = tlsConfig.Clone()
82-
// TODO(server): remove this hack which is necessary at least in
83-
// testing to get TestDRPCSelectQuery to pass.
84-
tlsConfig.InsecureSkipVerify = true
82+
sn, _, err := net.SplitHostPort(target)
83+
if err != nil {
84+
return nil, err
85+
}
86+
tlsConfig.ServerName = sn
8587
tlsConn := tls.Client(netConn, tlsConfig)
8688
conn = drpcconn.NewWithOptions(tlsConn, opts)
8789
}

0 commit comments

Comments
 (0)