| From f5e7f6c98b46ff622f60a4661ffc9ce07216d109 Mon Sep 17 00:00:00 2001 |
| From: Sebastian Andrzej Siewior <sebastian@breakpoint.cc> |
| Date: Sat, 29 Sep 2018 21:47:11 +0200 |
| Subject: [PATCH] boto: try to add SNI support |
| |
| Add SNI support. Newer OpenSSL (with TLS1.3) fail to connect if the |
| hostname is missing. |
| |
| Link: https://bugs.debian.org/bug=909545 |
| Tested-by: Witold Baryluk <witold.baryluk@gmail.com> |
| Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc> |
| --- |
| boto/connection.py | 19 ++++++++++--------- |
| boto/https_connection.py | 22 +++++++++++----------- |
| 2 files changed, 21 insertions(+), 20 deletions(-) |
| |
| diff --git a/boto/connection.py b/boto/connection.py |
| index 34b428f101df7..b4867a7657465 100644 |
| --- a/boto/connection.py |
| +++ b/boto/connection.py |
| @@ -778,8 +778,10 @@ |
| |
| def proxy_ssl(self, host=None, port=None): |
| if host and port: |
| + cert_host = host |
| host = '%s:%d' % (host, port) |
| else: |
| + cert_host = self.host |
| host = '%s:%d' % (self.host, self.port) |
| # Seems properly to use timeout for connect too |
| timeout = self.http_connection_kwargs.get("timeout") |
| @@ -824,23 +824,24 @@ DEFAULT_CA_CERTS_FILE = os.path.join(os.path.dirname(os.path.abspath(boto.cacert |
| h = http_client.HTTPConnection(host) |
| |
| if self.https_validate_certificates and HAVE_HTTPS_CONNECTION: |
| + context = ssl.create_default_context() |
| + context.verify_mode = ssl.CERT_REQUIRED |
| + context.check_hostname = True |
| + |
| msg = "wrapping ssl socket for proxied connection; " |
| if self.ca_certificates_file: |
| msg += "CA certificate file=%s" % self.ca_certificates_file |
| + context.load_verify_locations(cafile=self.ca_certificates_file) |
| else: |
| msg += "using system provided SSL certs" |
| + context.load_default_certs() |
| boto.log.debug(msg) |
| key_file = self.http_connection_kwargs.get('key_file', None) |
| cert_file = self.http_connection_kwargs.get('cert_file', None) |
| - sslSock = ssl.wrap_socket(sock, keyfile=key_file, |
| - certfile=cert_file, |
| - cert_reqs=ssl.CERT_REQUIRED, |
| - ca_certs=self.ca_certificates_file) |
| - cert = sslSock.getpeercert() |
| - hostname = self.host.split(':', 0)[0] |
| - if not https_connection.ValidateCertificateHostname(cert, hostname): |
| - raise https_connection.InvalidCertificateException( |
| - hostname, cert, 'hostname mismatch') |
| + if key_file: |
| + context.load_cert_chain(certfile=cert_file, keyfile=key_file) |
| + |
| + sslSock = context.wrap_socket(sock, server_hostname=cert_host) |
| else: |
| # Fallback for old Python without ssl.wrap_socket |
| if hasattr(http_client, 'ssl'): |
| diff --git a/boto/https_connection.py b/boto/https_connection.py |
| index ddc31a152292e..a5076f6f9b261 100644 |
| --- a/boto/https_connection.py |
| +++ b/boto/https_connection.py |
| @@ -119,20 +119,20 @@ from boto.compat import six, http_client |
| sock = socket.create_connection((self.host, self.port), self.timeout) |
| else: |
| sock = socket.create_connection((self.host, self.port)) |
| + |
| + context = ssl.create_default_context() |
| + context.verify_mode = ssl.CERT_REQUIRED |
| + context.check_hostname = True |
| + if self.key_file: |
| + context.load_cert_chain(certfile=self.cert_file, keyfile=self.key_file) |
| + |
| msg = "wrapping ssl socket; " |
| if self.ca_certs: |
| msg += "CA certificate file=%s" % self.ca_certs |
| + context.load_verify_locations(cafile=self.ca_certs) |
| else: |
| msg += "using system provided SSL certs" |
| + context.load_default_certs() |
| boto.log.debug(msg) |
| - self.sock = ssl.wrap_socket(sock, keyfile=self.key_file, |
| - certfile=self.cert_file, |
| - cert_reqs=ssl.CERT_REQUIRED, |
| - ca_certs=self.ca_certs) |
| - cert = self.sock.getpeercert() |
| - hostname = self.host.split(':', 0)[0] |
| - if not ValidateCertificateHostname(cert, hostname): |
| - raise InvalidCertificateException(hostname, |
| - cert, |
| - 'remote hostname "%s" does not match ' |
| - 'certificate' % hostname) |
| + |
| + self.sock = context.wrap_socket(sock, server_hostname=self.host) |
| -- |
| 2.19.0 |
| |
