From bd4fc118e54b0d7a5259e9556150973c9a759450 Mon Sep 17 00:00:00 2001 From: Prafful S <43948551+prafful1234@users.noreply.github.com> Date: Wed, 16 Jul 2025 12:06:19 +0530 Subject: [PATCH] feat: Database SSL one way support (#33044) * feat: Support one-way SSL authentication for database connections Updated MariaDB database connection to support one-way SSL authentication * feat(database): Add support for MySQLClient one-way SSL connections * feat: Format and pre-commit * fix: Default option for hostname check * chore: simplify Signed-off-by: Akhil Narang --------- Signed-off-by: Akhil Narang Co-authored-by: Akhil Narang --- frappe/database/mariadb/database.py | 15 +++++++++++---- frappe/database/mariadb/mysqlclient.py | 14 ++++++++++---- 2 files changed, 21 insertions(+), 8 deletions(-) diff --git a/frappe/database/mariadb/database.py b/frappe/database/mariadb/database.py index 35bb2335ad..50afa1ded4 100644 --- a/frappe/database/mariadb/database.py +++ b/frappe/database/mariadb/database.py @@ -142,12 +142,19 @@ class MariaDBConnectionUtil: if frappe.conf.local_infile: conn_settings["local_infile"] = frappe.conf.local_infile - if frappe.conf.db_ssl_ca and frappe.conf.db_ssl_cert and frappe.conf.db_ssl_key: - conn_settings["ssl"] = { + # Configure SSL settings + if frappe.conf.db_ssl_ca: + ssl_config = { "ca": frappe.conf.db_ssl_ca, - "cert": frappe.conf.db_ssl_cert, - "key": frappe.conf.db_ssl_key, + "check_hostname": frappe.conf.db_ssl_check_hostname, } + + # Add client certificates for mutual SSL if available + if frappe.conf.db_ssl_cert and frappe.conf.db_ssl_key: + ssl_config.update({"cert": frappe.conf.db_ssl_cert, "key": frappe.conf.db_ssl_key}) + + conn_settings["ssl"] = ssl_config + return conn_settings diff --git a/frappe/database/mariadb/mysqlclient.py b/frappe/database/mariadb/mysqlclient.py index 657f6dbf30..a844720057 100644 --- a/frappe/database/mariadb/mysqlclient.py +++ b/frappe/database/mariadb/mysqlclient.py @@ -143,13 +143,19 @@ class MariaDBConnectionUtil: if frappe.conf.local_infile: conn_settings["local_infile"] = frappe.conf.local_infile - if frappe.conf.db_ssl_ca and frappe.conf.db_ssl_cert and frappe.conf.db_ssl_key: - conn_settings["ssl"] = { + # Configure SSL settings + if frappe.conf.db_ssl_ca: + ssl_config = { "ca": frappe.conf.db_ssl_ca, - "cert": frappe.conf.db_ssl_cert, - "key": frappe.conf.db_ssl_key, + "check_hostname": frappe.conf.db_ssl_check_hostname, } + # Add client certificates for mutual SSL if available + if frappe.conf.db_ssl_cert and frappe.conf.db_ssl_key: + ssl_config.update({"cert": frappe.conf.db_ssl_cert, "key": frappe.conf.db_ssl_key}) + + conn_settings["ssl"] = ssl_config + return conn_settings