From 8014d9fee0e2a758d34af977f1ea6a1b6932a098 Mon Sep 17 00:00:00 2001 From: Aditi Sharma Date: Mon, 1 Mar 2021 18:12:19 +0530 Subject: [PATCH] Skip TLS verification for localhost Signed-off-by: Aditi Sharma --- pkg/cri/server/image_pull.go | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-) diff --git a/pkg/cri/server/image_pull.go b/pkg/cri/server/image_pull.go index 2165b3438..20a6d7168 100644 --- a/pkg/cri/server/image_pull.go +++ b/pkg/cri/server/image_pull.go @@ -337,6 +337,9 @@ func (c *criService) registryHosts(auth *runtime.AuthConfig) docker.RegistryHost if err != nil { return nil, errors.Wrapf(err, "get TLSConfig for registry %q", e) } + } else if isLocalHost(host) && u.Scheme == "http" { + // Skipping TLS verification for localhost + transport.TLSClientConfig.InsecureSkipVerify = true } if auth == nil && config.Auth != nil { @@ -366,15 +369,26 @@ func (c *criService) registryHosts(auth *runtime.AuthConfig) docker.RegistryHost // defaultScheme returns the default scheme for a registry host. func defaultScheme(host string) string { - if h, _, err := net.SplitHostPort(host); err == nil { - host = h - } - if host == "localhost" || host == "127.0.0.1" || host == "::1" { + if isLocalHost(host) { return "http" } return "https" } +// isLocalHost checks if the registry host is local. +func isLocalHost(host string) bool { + if h, _, err := net.SplitHostPort(host); err == nil { + host = h + } + + if host == "localhost" { + return true + } + + ip := net.ParseIP(host) + return ip.IsLoopback() +} + // addDefaultScheme returns the endpoint with default scheme func addDefaultScheme(endpoint string) (string, error) { if strings.Contains(endpoint, "://") {