From 7079d1eb7ad4f1a489dd4341049b30689fd458ac Mon Sep 17 00:00:00 2001 From: sauagarwa Date: Sun, 9 Aug 2026 18:10:26 -0400 Subject: [PATCH 1/2] fix(gateway-interceptors): apply tls-native-roots for HTTPS interceptor endpoints Endpoint::connect() does not apply TLS configuration automatically for https:// URLs even with tls-native-roots feature enabled. Add explicit .tls_config(ClientTlsConfig::new()) when the endpoint uses HTTPS so tonic uses the system's native root certificate store. Fixes #2665 --- crates/openshell-gateway-interceptors/src/plan.rs | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/crates/openshell-gateway-interceptors/src/plan.rs b/crates/openshell-gateway-interceptors/src/plan.rs index b65d5612fd..9cea12f7d3 100644 --- a/crates/openshell-gateway-interceptors/src/plan.rs +++ b/crates/openshell-gateway-interceptors/src/plan.rs @@ -19,7 +19,7 @@ use openshell_core::proto::gateway_interceptor::v1::{ use tokio::net::UnixStream; use tonic::Request; use tonic::codegen::http::Uri; -use tonic::transport::{Channel, Endpoint}; +use tonic::transport::{Channel, ClientTlsConfig, Endpoint}; use tower::service_fn; use tracing::{info, warn}; @@ -862,11 +862,16 @@ async fn connect_endpoint(endpoint: &str) -> Result { if let Some(path) = endpoint.strip_prefix("unix://") { return connect_unix_endpoint(PathBuf::from(path)).await; } - Endpoint::from_shared(endpoint.to_string()) + let mut ep = Endpoint::from_shared(endpoint.to_string()) .map_err(|e| { InterceptorError::Config(format!("invalid interceptor endpoint '{endpoint}': {e}")) - })? - .connect() + })?; + if endpoint.starts_with("https://") { + ep = ep.tls_config(ClientTlsConfig::new().with_enabled_roots()).map_err(|e| { + InterceptorError::Config(format!("TLS config for interceptor endpoint '{endpoint}': {e}")) + })?; + } + ep.connect() .await .map_err(|e| InterceptorError::Transport(format!("connect {endpoint}: {e}"))) } From 866031c323b4ae8fe4aaccc207a0a82c14da333a Mon Sep 17 00:00:00 2001 From: Drew Newberry Date: Sun, 9 Aug 2026 19:39:10 -0700 Subject: [PATCH 2/2] fix(gateway-interceptors): detect parsed HTTPS scheme Signed-off-by: Drew Newberry --- .../src/plan.rs | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/crates/openshell-gateway-interceptors/src/plan.rs b/crates/openshell-gateway-interceptors/src/plan.rs index 9cea12f7d3..927bfc88b2 100644 --- a/crates/openshell-gateway-interceptors/src/plan.rs +++ b/crates/openshell-gateway-interceptors/src/plan.rs @@ -862,14 +862,17 @@ async fn connect_endpoint(endpoint: &str) -> Result { if let Some(path) = endpoint.strip_prefix("unix://") { return connect_unix_endpoint(PathBuf::from(path)).await; } - let mut ep = Endpoint::from_shared(endpoint.to_string()) - .map_err(|e| { - InterceptorError::Config(format!("invalid interceptor endpoint '{endpoint}': {e}")) - })?; - if endpoint.starts_with("https://") { - ep = ep.tls_config(ClientTlsConfig::new().with_enabled_roots()).map_err(|e| { - InterceptorError::Config(format!("TLS config for interceptor endpoint '{endpoint}': {e}")) - })?; + let mut ep = Endpoint::from_shared(endpoint.to_string()).map_err(|e| { + InterceptorError::Config(format!("invalid interceptor endpoint '{endpoint}': {e}")) + })?; + if ep.uri().scheme_str() == Some("https") { + ep = ep + .tls_config(ClientTlsConfig::new().with_enabled_roots()) + .map_err(|e| { + InterceptorError::Config(format!( + "TLS config for interceptor endpoint '{endpoint}': {e}" + )) + })?; } ep.connect() .await