howler-api 3.1.0.dev391__tar.gz → 3.1.0.dev393__tar.gz

{howler_api-3.1.0.dev391 → howler_api-3.1.0.dev393}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: howler-api
-Version: 3.1.0.dev391
+Version: 3.1.0.dev393
 Summary: Howler - API server
 License: MIT
 Keywords: howler,alerting,gc,canada,cse-cst,cse,cst,cyber,cccs

{howler_api-3.1.0.dev391 → howler_api-3.1.0.dev393}/howler/datastore/store.py

@@ -69,6 +69,7 @@ class ESStore(object):
         self._password: Optional[str] = None
         self._hosts = []
         self._cert: str | None = None
+        self._fingerprint: str | None = None
 
         for host in config.datastore.hosts:
             self._hosts.append(str(host))
@@ -77,6 +78,7 @@ class ESStore(object):
             if cert.exists():
                 if self._cert is None:
                     self._cert = str(cert)
+                    logger.info("Using certificate %s for elasticsearch network traffic", self._cert)
                 else:
                     logger.error("Only a single certificate path is supported - ignoring additional paths.")
                     logger.error(
@@ -84,6 +86,15 @@ class ESStore(object):
                         "it for the first host."
                     )
 
+            if host.fingerprint:
+                if self._fingerprint is None:
+                    self._fingerprint = host.fingerprint
+                    logger.info("Using certificate fingerprint %s for elasticsearch network traffic", self._fingerprint)
+                else:
+                    logger.error(
+                        "Only a single certificate fingerprint is supported - ignoring additional fingerprints."
+                    )
+
             if os.getenv(f"{host.name.upper()}_HOST_APIKEY_ID", None) is not None:
                 self._apikey = (
                     os.environ[f"{host.name.upper()}_HOST_APIKEY_ID"],
@@ -105,6 +116,7 @@ class ESStore(object):
             self.client = elasticsearch.Elasticsearch(
                 hosts=self._hosts,  # type: ignore
                 ca_certs=self._cert,  # type: ignore
+                ssl_assert_fingerprint=self._fingerprint,  # type: ignore
                 api_key=self._apikey,
                 max_retries=0,
                 request_timeout=TRANSPORT_TIMEOUT,
@@ -113,6 +125,7 @@ class ESStore(object):
             self.client = elasticsearch.Elasticsearch(
                 hosts=self._hosts,  # type: ignore
                 ca_certs=self._cert,  # type: ignore
+                ssl_assert_fingerprint=self._fingerprint,  # type: ignore
                 basic_auth=(self._username, self._password),
                 max_retries=0,
                 request_timeout=TRANSPORT_TIMEOUT,
@@ -121,6 +134,7 @@ class ESStore(object):
             self.client = elasticsearch.Elasticsearch(
                 hosts=self._hosts,  # type: ignore
                 ca_certs=self._cert,  # type: ignore
+                ssl_assert_fingerprint=self._fingerprint,  # type: ignore
                 max_retries=0,
                 request_timeout=TRANSPORT_TIMEOUT,
             )

{howler_api-3.1.0.dev391 → howler_api-3.1.0.dev393}/howler/odm/models/config.py

@@ -63,6 +63,9 @@ class Host(BaseModel):
     apikey_secret: Optional[str] = Field(description="Secret data of the API Key to use when connecting", default=None)
     scheme: Optional[str] = Field(description="Scheme to use when connecting", default="http")
     host: str = Field(description="URL to connect to")
+    fingerprint: str | None = Field(
+        description="Optional certificate fingerprint to validate against when connecting to datastore", default=None
+    )
 
     def __repr__(self):
         result = ""

{howler_api-3.1.0.dev391 → howler_api-3.1.0.dev393}/pyproject.toml

@@ -148,7 +148,7 @@ suppress-none-returning = true
 [tool.poetry]
 package-mode = true
 name = "howler-api"
-version = "3.1.0.dev391"
+version = "3.1.0.dev393"
 description = "Howler - API server"
 authors = [
     "Canadian Centre for Cyber Security <howler@cyber.gc.ca>",