feat(TLS): Support skipCertCheck option to bypass certificate check

This option allows for connecting to Milvus instances with self-signed certificates, without the need to pass the certificate DCO 1.1 Signed-off-by: Zander Bobronnikov <[email protected]> Signed-off-by: Zander Bobronnikov <[email protected]>
milvus-io · Nov 5, 2024 · 1f48880 · 1f48880
1 parent ab7357d
commit 1f48880
Show file tree

Hide file tree

Showing 6 changed files with 548 additions and 815 deletions.
diff --git a/milvus/const/client.ts b/milvus/const/client.ts
@@ -16,4 +16,5 @@ export enum TLS_MODE {
   DISABLED,
   ONE_WAY,
   TWO_WAY,
+  UNAUTHORIZED
 }
diff --git a/milvus/grpc/BaseClient.ts b/milvus/grpc/BaseClient.ts
@@ -7,6 +7,7 @@ import {
   ChannelOptions,
   credentials,
   ChannelCredentials,
+  VerifyOptions,
 } from '@grpc/grpc-js';
 import { Pool } from 'generic-pool';
 import {
@@ -173,6 +174,8 @@ export class BaseClient {
         ? TLS_MODE.TWO_WAY
         : this.tlsMode;
 
+    this.tlsMode = this.config.tls?.skipCertCheck ? TLS_MODE.UNAUTHORIZED : this.tlsMode;
+
     // Create credentials based on the TLS mode
     switch (this.tlsMode) {
       case TLS_MODE.ONE_WAY:
@@ -216,6 +219,14 @@ export class BaseClient {
           verifyOptions
         );
         break;
+      case TLS_MODE.UNAUTHORIZED:
+        const opts: VerifyOptions = {
+          checkServerIdentity : () => { return undefined; },
+          rejectUnauthorized : false
+        };
+
+        this.creds = credentials.createSsl(null, null, null, opts);
+        break;
       default:
         // If no TLS mode is specified, create insecure credentials
         this.creds = credentials.createInsecure();

diff --git a/milvus/types/Client.ts b/milvus/types/Client.ts
@@ -54,6 +54,8 @@ export interface ClientConfig {
     verifyOptions?: Record<string, any>;
     // server name
     serverName?: string;
+    // skip certificate check entirely
+    skipCertCheck?: boolean;
   };
 
   // generic-pool options: refer to https://github.com/coopernurse/node-pool

diff --git a/package.json b/package.json
@@ -20,7 +20,7 @@
     "doc-json": "npx typedoc milvus --json"
   },
   "dependencies": {
-    "@grpc/grpc-js": "^1.8.22",
+    "@grpc/grpc-js": "^1.12.1",
     "@grpc/proto-loader": "^0.7.10",
     "@petamoriken/float16": "^3.8.6",
     "dayjs": "^1.11.7",

diff --git a/test/grpc/MilvusClient.spec.ts b/test/grpc/MilvusClient.spec.ts
@@ -68,6 +68,21 @@ describe(`Milvus client`, () => {
     expect(m1s.clientId).toEqual('1');
   });
 
+  it(`should create a grpc client with skipCertCheck option successfully`, async () => {
+    const m1u = new MilvusClient({
+      address: IP,
+      tls: {
+        skipCertCheck : true
+      },
+      id: '1',
+      __SKIP_CONNECT__: true,
+    });
+
+    expect(await m1u.channelPool).toBeDefined();
+    expect(m1u.tlsMode).toEqual(TLS_MODE.UNAUTHORIZED);
+    expect(m1u.clientId).toEqual('1');
+  });
+
   it(`should create a grpc client without SSL credentials when ssl is false`, async () => {
     const m2 = new MilvusClient({
       address: IP,