Matrix-Mirrors/anonymousland-synapse
1
0
Fork 0
mirror of https://git.anonymousland.org/anonymousland/synapse.git synced 2025-08-09 19:42:14 -04:00
Code Issues Projects Releases Packages Wiki Activity

Fix well-known lookups with the federation certificate whitelist (#5997)

Browse source
This commit is contained in:
Amber Brown 2019-09-14 04:58:38 +10:00 • committed by GitHub
parent c755955f33
commit 850dcfd2d3
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
5 changed files with 63 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

40
tests/config/test_tls.py
View file

@ -16,6 +16,7 @@
import os
import idna
import yaml
from OpenSSL import SSL
@ -235,3 +236,42 @@ s4niecZKPBizL6aucT59CsunNmmb5Glq8rlAcU+1ZTZZzGYqVYhF6axB9Qg=
)
self.assertTrue(conf.acme_enabled)
def test_whitelist_idna_failure(self):
"""
The federation certificate whitelist will not allow IDNA domain names.
"""
config = {
"federation_certificate_verification_whitelist": [
"example.com",
"*.ドメイン.テスト",
]
}
t = TestConfig()
e = self.assertRaises(
ConfigError, t.read_config, config, config_dir_path="", data_dir_path=""
)
self.assertIn("IDNA domain names", str(e))
def test_whitelist_idna_result(self):
"""
The federation certificate whitelist will match on IDNA encoded names.
"""
config = {
"federation_certificate_verification_whitelist": [
"example.com",
"*.xn--eckwd4c7c.xn--zckzah",
]
}
t = TestConfig()
t.read_config(config, config_dir_path="", data_dir_path="")
cf = ClientTLSOptionsFactory(t)
# Not in the whitelist
opts = cf.get_options(b"notexample.com")
self.assertTrue(opts._verifier._verify_certs)
# Caught by the wildcard
opts = cf.get_options(idna.encode("テスト.ドメイン.テスト"))
self.assertFalse(opts._verifier._verify_certs)