Enable TLS certificate verification for Elasticsearch client (#179)

Instead of silently disabling TLS verification when tlsServerName is
not provided, always verify server certificates. An empty ServerName
defers to http.Transport's default hostname check against the request
URL; set tlsServerName only when the certificate DNS name differs from
the host used to reach the server.

Related-To: OSPRH-33323

Signed-off-by: Daniel Pawlik <dpawlik@redhat.com>

Author: danpawlik

plugins/application/elasticsearch/pkg/lib/client.go

@@ -44,14 +44,10 @@ func createTLSConfig(serverName string, certFile string, keyFile string, caFile
 
 	tlsConfig := &tls.Config{
 		MinVersion:   tls.VersionTLS13,
+		ServerName:   serverName,
 		Certificates: []tls.Certificate{cert},
 		RootCAs:      certPool,
 	}
-	if len(serverName) == 0 {
-		tlsConfig.InsecureSkipVerify = true
-	} else {
-		tlsConfig.ServerName = serverName
-	}
 
 	return tlsConfig, nil
 }

plugins/application/elasticsearch/pkg/lib/client_test.go

@@ -123,15 +123,18 @@ func TestElasticsearchTLSConf(t *testing.T) {
 	cacrtpath := path.Join(tmpdir, "ca.pem")
 	require.NoError(t, os.WriteFile(cacrtpath, []byte(testCa), 0600))
 
-	t.Run("Test insecure connection.", func(t *testing.T) {
+	t.Run("Test explicit server name.", func(t *testing.T) {
 		tlsConf, err := createTLSConfig("overmind.localdomain", certpath, keypath, cacrtpath)
 		require.NoError(t, err)
 		assert.Equal(t, "overmind.localdomain", tlsConf.ServerName)
-		assert.Equal(t, false, tlsConf.InsecureSkipVerify)
+		assert.False(t, tlsConf.InsecureSkipVerify)
+	})
 
-		tlsConf, err = createTLSConfig("", certpath, keypath, cacrtpath)
+	t.Run("Test empty server name defers to transport.", func(t *testing.T) {
+		tlsConf, err := createTLSConfig("", certpath, keypath, cacrtpath)
 		require.NoError(t, err)
-		assert.Equal(t, true, tlsConf.InsecureSkipVerify)
+		assert.Equal(t, "", tlsConf.ServerName)
+		assert.False(t, tlsConf.InsecureSkipVerify)
 	})
 }