diff --git a/synapse/crypto/context_factory.py b/synapse/crypto/context_factory.py
index 415899e62b..e93afbf975 100644
--- a/synapse/crypto/context_factory.py
+++ b/synapse/crypto/context_factory.py
@@ -11,18 +11,19 @@
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
+import logging
-from twisted.internet import ssl
+import idna
from OpenSSL import SSL, crypto
-from twisted.internet._sslverify import _defaultCurveName, ClientTLSOptions, \
- OpenSSLCertificateOptions, optionsForClientTLS
-
-import logging
+from twisted.internet.ssl import ContextFactory, CertificateOptions
+from twisted.internet._sslverify import _defaultCurveName, _tolerateErrors
+from twisted.internet.interfaces import IOpenSSLClientConnectionCreator
+from zope.interface import implementer
logger = logging.getLogger(__name__)
-class ServerContextFactory(ssl.ContextFactory):
+class ServerContextFactory(ContextFactory):
"""Factory for PyOpenSSL SSL contexts that are used to handle incoming
connections and to make connections to remote servers."""
@@ -51,18 +52,31 @@ class ServerContextFactory(ssl.ContextFactory):
return self._context
-class ClientTLSOptionsNoCertVerification(ClientTLSOptions):
- """Redefinition of ClientTLSOptions to completely ignore certificate
- validation. Should be kept in sync with the original class in Twisted.
- This version of ClientTLSOptions is only intended for development use."""
+@implementer(IOpenSSLClientConnectionCreator)
+class ClientTLSOptions(object):
+ """
+ Client creator for TLS without certificate identity verification. This is a
+ copy of twisted.internet._sslverify.ClientTLSOptions with the identity
+ verification left out. For documentation, see the twisted documentation.
+ """
- def __init__(self, *args, **kwargs):
- super(ClientTLSOptionsNoCertVerification, self).__init__(*args, **kwargs)
+ def __init__(self, hostname, ctx):
+ self._ctx = ctx
+ self._hostname = hostname
+ self._hostnameBytes = idna.encode(hostname)
+ ctx.set_info_callback(
+ _tolerateErrors(self._identityVerifyingInfoCallback)
+ )
- def do_nothing(*_args, **_kwargs):
- pass
+ def clientConnectionForTLS(self, tlsProtocol):
+ context = self._ctx
+ connection = SSL.Connection(context, None)
+ connection.set_app_data(tlsProtocol)
+ return connection
- self._ctx.set_info_callback(do_nothing)
+ def _identityVerifyingInfoCallback(self, connection, where, ret):
+ if where & SSL.SSL_CB_HANDSHAKE_START:
+ connection.set_tlsext_host_name(self._hostnameBytes)
class ClientTLSOptionsFactory(object):
@@ -70,13 +84,11 @@ class ClientTLSOptionsFactory(object):
to remote servers for federation."""
def __init__(self, config):
- self._ignore_certificate_validation = config.tls_ignore_certificate_validation
+ # We don't use config options yet
+ pass
def get_options(self, host):
- if self._ignore_certificate_validation:
- return ClientTLSOptionsNoCertVerification(
- unicode(host),
- OpenSSLCertificateOptions(verify=False).getContext()
- )
- else:
- return optionsForClientTLS(unicode(host))
+ return ClientTLSOptions(
+ unicode(host),
+ CertificateOptions(verify=False).getContext()
+ )
|
