From f5e7f6c98b46ff622f60a4661ffc9ce07216d109 Mon Sep 17 00:00:00 2001 From: Sebastian Andrzej Siewior Date: Sat, 29 Sep 2018 21:47:11 +0200 Subject: [PATCH] boto: try to add SNI support Add SNI support. Newer OpenSSL (with TLS1.3) fail to connect if the hostname is missing. Link: https://bugs.debian.org/bug=909545 Tested-by: Witold Baryluk Signed-off-by: Sebastian Andrzej Siewior --- boto/connection.py | 19 ++++++++++--------- boto/https_connection.py | 22 +++++++++++----------- 2 files changed, 21 insertions(+), 20 deletions(-) diff --git a/boto/connection.py b/boto/connection.py index 34b428f101df7..b4867a7657465 100644 --- a/boto/connection.py +++ b/boto/connection.py @@ -778,8 +778,10 @@ def proxy_ssl(self, host=None, port=None): if host and port: + cert_host = host host = '%s:%d' % (host, port) else: + cert_host = self.host host = '%s:%d' % (self.host, self.port) # Seems properly to use timeout for connect too timeout = self.http_connection_kwargs.get("timeout") @@ -824,23 +824,24 @@ DEFAULT_CA_CERTS_FILE = os.path.join(os.path.dirname(os.path.abspath(boto.cacert h = http_client.HTTPConnection(host) if self.https_validate_certificates and HAVE_HTTPS_CONNECTION: + context = ssl.create_default_context() + context.verify_mode = ssl.CERT_REQUIRED + context.check_hostname = True + msg = "wrapping ssl socket for proxied connection; " if self.ca_certificates_file: msg += "CA certificate file=%s" % self.ca_certificates_file + context.load_verify_locations(cafile=self.ca_certificates_file) else: msg += "using system provided SSL certs" + context.load_default_certs() boto.log.debug(msg) key_file = self.http_connection_kwargs.get('key_file', None) cert_file = self.http_connection_kwargs.get('cert_file', None) - sslSock = ssl.wrap_socket(sock, keyfile=key_file, - certfile=cert_file, - cert_reqs=ssl.CERT_REQUIRED, - ca_certs=self.ca_certificates_file) - cert = sslSock.getpeercert() - hostname = self.host.split(':', 0)[0] - if not https_connection.ValidateCertificateHostname(cert, hostname): - raise https_connection.InvalidCertificateException( - hostname, cert, 'hostname mismatch') + if key_file: + context.load_cert_chain(certfile=cert_file, keyfile=key_file) + + sslSock = context.wrap_socket(sock, server_hostname=cert_host) else: # Fallback for old Python without ssl.wrap_socket if hasattr(http_client, 'ssl'): diff --git a/boto/https_connection.py b/boto/https_connection.py index ddc31a152292e..a5076f6f9b261 100644 --- a/boto/https_connection.py +++ b/boto/https_connection.py @@ -119,20 +119,20 @@ from boto.compat import six, http_client sock = socket.create_connection((self.host, self.port), self.timeout) else: sock = socket.create_connection((self.host, self.port)) + + context = ssl.create_default_context() + context.verify_mode = ssl.CERT_REQUIRED + context.check_hostname = True + if self.key_file: + context.load_cert_chain(certfile=self.cert_file, keyfile=self.key_file) + msg = "wrapping ssl socket; " if self.ca_certs: msg += "CA certificate file=%s" % self.ca_certs + context.load_verify_locations(cafile=self.ca_certs) else: msg += "using system provided SSL certs" + context.load_default_certs() boto.log.debug(msg) - self.sock = ssl.wrap_socket(sock, keyfile=self.key_file, - certfile=self.cert_file, - cert_reqs=ssl.CERT_REQUIRED, - ca_certs=self.ca_certs) - cert = self.sock.getpeercert() - hostname = self.host.split(':', 0)[0] - if not ValidateCertificateHostname(cert, hostname): - raise InvalidCertificateException(hostname, - cert, - 'remote hostname "%s" does not match ' - 'certificate' % hostname) + + self.sock = context.wrap_socket(sock, server_hostname=self.host) -- 2.19.0