mirror of
https://git.anonymousland.org/anonymousland/synapse.git
synced 2024-09-07 15:02:59 +00:00
allow self-signed certificates
This commit is contained in:
parent
07b4f88de9
commit
b7f34ee348
@ -47,10 +47,6 @@ class TlsConfig(Config):
|
||||
|
||||
self.tls_fingerprints = config["tls_fingerprints"]
|
||||
|
||||
self.tls_ignore_certificate_validation = config.get(
|
||||
"tls_ignore_certificate_validation", False
|
||||
)
|
||||
|
||||
# Check that our own certificate is included in the list of fingerprints
|
||||
# and include it if it is not.
|
||||
x509_certificate_bytes = crypto.dump_certificate(
|
||||
@ -77,8 +73,6 @@ class TlsConfig(Config):
|
||||
tls_private_key_path = base_key_name + ".tls.key"
|
||||
tls_dh_params_path = base_key_name + ".tls.dh"
|
||||
|
||||
tls_ignore_certificate_validation = False
|
||||
|
||||
return """\
|
||||
# PEM encoded X509 certificate for TLS.
|
||||
# You can replace the self-signed certificate that synapse
|
||||
@ -123,11 +117,6 @@ class TlsConfig(Config):
|
||||
#
|
||||
tls_fingerprints: []
|
||||
# tls_fingerprints: [{"sha256": "<base64_encoded_sha256_fingerprint>"}]
|
||||
|
||||
# Ignore certificate validation for TLS client connections to other
|
||||
# homeservers using federation. Don't enable this in a production
|
||||
# environment, unless you know what you are doing!
|
||||
tls_ignore_certificate_validation: %(tls_ignore_certificate_validation)s
|
||||
""" % locals()
|
||||
|
||||
def read_tls_certificate(self, cert_path):
|
||||
|
@ -11,18 +11,19 @@
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
from twisted.internet import ssl
|
||||
from OpenSSL import SSL, crypto
|
||||
from twisted.internet._sslverify import _defaultCurveName, ClientTLSOptions, \
|
||||
OpenSSLCertificateOptions, optionsForClientTLS
|
||||
|
||||
import logging
|
||||
|
||||
import idna
|
||||
from OpenSSL import SSL, crypto
|
||||
from twisted.internet.ssl import ContextFactory, CertificateOptions
|
||||
from twisted.internet._sslverify import _defaultCurveName, _tolerateErrors
|
||||
from twisted.internet.interfaces import IOpenSSLClientConnectionCreator
|
||||
from zope.interface import implementer
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
|
||||
class ServerContextFactory(ssl.ContextFactory):
|
||||
class ServerContextFactory(ContextFactory):
|
||||
"""Factory for PyOpenSSL SSL contexts that are used to handle incoming
|
||||
connections and to make connections to remote servers."""
|
||||
|
||||
@ -51,18 +52,31 @@ class ServerContextFactory(ssl.ContextFactory):
|
||||
return self._context
|
||||
|
||||
|
||||
class ClientTLSOptionsNoCertVerification(ClientTLSOptions):
|
||||
"""Redefinition of ClientTLSOptions to completely ignore certificate
|
||||
validation. Should be kept in sync with the original class in Twisted.
|
||||
This version of ClientTLSOptions is only intended for development use."""
|
||||
@implementer(IOpenSSLClientConnectionCreator)
|
||||
class ClientTLSOptions(object):
|
||||
"""
|
||||
Client creator for TLS without certificate identity verification. This is a
|
||||
copy of twisted.internet._sslverify.ClientTLSOptions with the identity
|
||||
verification left out. For documentation, see the twisted documentation.
|
||||
"""
|
||||
|
||||
def __init__(self, *args, **kwargs):
|
||||
super(ClientTLSOptionsNoCertVerification, self).__init__(*args, **kwargs)
|
||||
def __init__(self, hostname, ctx):
|
||||
self._ctx = ctx
|
||||
self._hostname = hostname
|
||||
self._hostnameBytes = idna.encode(hostname)
|
||||
ctx.set_info_callback(
|
||||
_tolerateErrors(self._identityVerifyingInfoCallback)
|
||||
)
|
||||
|
||||
def do_nothing(*_args, **_kwargs):
|
||||
pass
|
||||
def clientConnectionForTLS(self, tlsProtocol):
|
||||
context = self._ctx
|
||||
connection = SSL.Connection(context, None)
|
||||
connection.set_app_data(tlsProtocol)
|
||||
return connection
|
||||
|
||||
self._ctx.set_info_callback(do_nothing)
|
||||
def _identityVerifyingInfoCallback(self, connection, where, ret):
|
||||
if where & SSL.SSL_CB_HANDSHAKE_START:
|
||||
connection.set_tlsext_host_name(self._hostnameBytes)
|
||||
|
||||
|
||||
class ClientTLSOptionsFactory(object):
|
||||
@ -70,13 +84,11 @@ class ClientTLSOptionsFactory(object):
|
||||
to remote servers for federation."""
|
||||
|
||||
def __init__(self, config):
|
||||
self._ignore_certificate_validation = config.tls_ignore_certificate_validation
|
||||
# We don't use config options yet
|
||||
pass
|
||||
|
||||
def get_options(self, host):
|
||||
if self._ignore_certificate_validation:
|
||||
return ClientTLSOptionsNoCertVerification(
|
||||
return ClientTLSOptions(
|
||||
unicode(host),
|
||||
OpenSSLCertificateOptions(verify=False).getContext()
|
||||
CertificateOptions(verify=False).getContext()
|
||||
)
|
||||
else:
|
||||
return optionsForClientTLS(unicode(host))
|
||||
|
@ -65,7 +65,7 @@ def matrix_federation_endpoint(reactor, destination, tls_client_options_factory=
|
||||
else:
|
||||
def transport_endpoint(reactor, host, port, timeout):
|
||||
return wrapClientTLS(
|
||||
tls_client_options_factory.get_options(unicode(host)),
|
||||
tls_client_options_factory.get_options(host),
|
||||
HostnameEndpoint(reactor, host, port, timeout=timeout))
|
||||
default_port = 8448
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user