Allow HTTPS requests to use tls_ciphers
#20179
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Codecov ReportAttention: Patch coverage is
Additional details and impacted files
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
dkirov-dd
force-pushed
the
dk/AGENT-12451/tls-ciphers
branch
from
c6b0da6 to
0eeb208
Compare
dkirov-dd
force-pushed
the
dk/AGENT-12451/tls-ciphers
branch
from
0eeb208 to
63b5b09
Compare
datadog-agent-integrations-bot
bot
added
integration/envoy
integration/haproxy
integration/kube_dns
integration/kube_proxy
integration/kubelet
integration/powerdns_recursor
integration/spark
integration/vsphere
integration/vault
integration/kube_controller_manager
integration/twistlock
integration/kube_scheduler
integration/kube_metrics_server
integration/amazon_msk
integration/voltdb
integration/citrix_hypervisor
integration/arangodb
integration/cert_manager
integration/vllm
labels
iliakur
reviewed
Jun 19, 2025
3 tasks
Co-authored-by: Ilia Kurenkov <[email protected]>
iliakur
requested changes
Jun 28, 2025
| def create_ssl_context(config, overrides=None): | ||
| # https://docs.python.org/3/library/ssl.html#ssl.SSLContext | ||
| # https://docs.python.org/3/library/ssl.html#ssl.PROTOCOL_TLS_CLIENT | ||
| context = ssl.SSLContext(protocol=ssl.PROTOCOL_TLS) |
There was a problem hiding this comment.
I got my wires crossed, was thinking about this vulnerability case, which is about a different thing.
In a separate PR we can probably change the protocol constant to be PROTOCOL_TLS_CLIENT
| elif isinstance(verify, bool): | ||
| tls_config["tls_verify"] = verify | ||
| else: | ||
| LOGGER.warning( |
There was a problem hiding this comment.
-1 on the warning. Let's decide if this is a blocker for the user. If yes, we crash with an error that explains how to fix it.
If no, we have to flesh out what our backup plan is. In that case a debug here would make sense to let support/devs know we've hit this condition as they troubleshoot.
Comment on lines
+144
to
+145
| # This is used to determine if the adapter was created with a custom context | ||
| # for the purpose of reverting to the default context when needed. |
There was a problem hiding this comment.
Suggested change
| # This is used to determine if the adapter was created with a custom context | |
| # for the purpose of reverting to the default context when needed. |
Comment on lines
+627
to
+631
| https_adapter = self._https_adapters.get(tls_config_key) | ||
|
|
||
| if https_adapter is not None: | ||
| session.mount('https://', https_adapter) | ||
| return |
There was a problem hiding this comment.
Suggested change
| https_adapter = self._https_adapters.get(tls_config_key) | |
| if https_adapter is not None: | |
| session.mount('https://', https_adapter) | |
| return | |
| if tls_config_key in self._https_adapters: | |
| session.mount('https://', self._https_adapters[tls_config_key]) | |
| return |
simpler
|
|
||
| https_adapter = SSLContextHostHeaderAdapter(context) | ||
| else: | ||
| # Use SSLContextHTTPSAdapter for consistent TLS configuration |
There was a problem hiding this comment.
Suggested change
| # Use SSLContextHTTPSAdapter for consistent TLS configuration |
That comment is from another version of the code.
| else: | ||
| updated_ciphers = ":".join(ciphers) | ||
| self.tls_ciphers_allowed = updated_ciphers | ||
| # Create TLS context for consistent TLS configuration |
There was a problem hiding this comment.
Suggested change
| # Create TLS context for consistent TLS configuration |
Leftover from previous implementation. Not sure we need much explanation here.
Comment on lines
+593
to
+594
| for option, value in self.options.items(): | ||
| setattr(session, option, value) |
There was a problem hiding this comment.
Not for this PR because this existed before, but aren't we supposed to take into account also new_options here?
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What does this PR do?
This PR modifies the behavior of the
RequestsWrapperto make use ofrequests.Sessionfor all requests.It extends the allowed TLS ciphers to all those that are allowed by the compile-time configuration.
This was achieved using the
Sessionclass's HTTPSAdapter, which passes the customSSLContextto the underlyingurllib3functions.Note
Many unit and integration tests that were previously mocking
requests.getor otherrequestsmethods needed to be re-written with these changes in mind.N.B: These test should most likely be rewritten in a subsequent PR to use higher-level mocks. This would prevent future PRs that would change logic inside the
RequestsWrapperto have to fix hundreds of tests.Motivation
The integration config provides a
tls_ciphersparameter that was not utilized uniformly throughout HTTPS requests. Most notably, it had no effect on the requests made through the AgentCheck'shttpattribute.Allowing the modification of cipher suites is essential to support the broadest array of use cases.
For example, some users have endpoints that do not accept any of Python's ssl.SSLCipher default cipher suites, leading to these endpoints being unusable with our checks.
Important
The goal for this PR is to only extend the realm of usable endpoints for end users.
All existing interfaces, inputs, and outputs remain unchanged.
No user action is required to benefit from the improvements.
Review checklist (to be filled by reviewers)
qa/skip-qalabel if the PR doesn't need to be tested during QA.backport/<branch-name>label to the PR and it will automatically open a backport PR once this one is merged