diff --git a/synapse/config/tls.py b/synapse/config/tls.py
index b09dc986ab..b66154bc7c 100644
--- a/synapse/config/tls.py
+++ b/synapse/config/tls.py
@@ -47,10 +47,6 @@ class TlsConfig(Config):
self.tls_fingerprints = config["tls_fingerprints"]
- self.tls_ignore_certificate_validation = config.get(
- "tls_ignore_certificate_validation", False
- )
-
# Check that our own certificate is included in the list of fingerprints
# and include it if it is not.
x509_certificate_bytes = crypto.dump_certificate(
@@ -77,8 +73,6 @@ class TlsConfig(Config):
tls_private_key_path = base_key_name + ".tls.key"
tls_dh_params_path = base_key_name + ".tls.dh"
- tls_ignore_certificate_validation = False
-
return """\
# PEM encoded X509 certificate for TLS.
# You can replace the self-signed certificate that synapse
@@ -123,11 +117,6 @@ class TlsConfig(Config):
#
tls_fingerprints: []
# tls_fingerprints: [{"sha256": "<base64_encoded_sha256_fingerprint>"}]
-
- # Ignore certificate validation for TLS client connections to other
- # homeservers using federation. Don't enable this in a production
- # environment, unless you know what you are doing!
- tls_ignore_certificate_validation: %(tls_ignore_certificate_validation)s
""" % locals()
def read_tls_certificate(self, cert_path):
diff --git a/synapse/crypto/context_factory.py b/synapse/crypto/context_factory.py
index 415899e62b..e93afbf975 100644
--- a/synapse/crypto/context_factory.py
+++ b/synapse/crypto/context_factory.py
@@ -11,18 +11,19 @@
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
+import logging
-from twisted.internet import ssl
+import idna
from OpenSSL import SSL, crypto
-from twisted.internet._sslverify import _defaultCurveName, ClientTLSOptions, \
- OpenSSLCertificateOptions, optionsForClientTLS
-
-import logging
+from twisted.internet.ssl import ContextFactory, CertificateOptions
+from twisted.internet._sslverify import _defaultCurveName, _tolerateErrors
+from twisted.internet.interfaces import IOpenSSLClientConnectionCreator
+from zope.interface import implementer
logger = logging.getLogger(__name__)
-class ServerContextFactory(ssl.ContextFactory):
+class ServerContextFactory(ContextFactory):
"""Factory for PyOpenSSL SSL contexts that are used to handle incoming
connections and to make connections to remote servers."""
@@ -51,18 +52,31 @@ class ServerContextFactory(ssl.ContextFactory):
return self._context
-class ClientTLSOptionsNoCertVerification(ClientTLSOptions):
- """Redefinition of ClientTLSOptions to completely ignore certificate
- validation. Should be kept in sync with the original class in Twisted.
- This version of ClientTLSOptions is only intended for development use."""
+@implementer(IOpenSSLClientConnectionCreator)
+class ClientTLSOptions(object):
+ """
+ Client creator for TLS without certificate identity verification. This is a
+ copy of twisted.internet._sslverify.ClientTLSOptions with the identity
+ verification left out. For documentation, see the twisted documentation.
+ """
- def __init__(self, *args, **kwargs):
- super(ClientTLSOptionsNoCertVerification, self).__init__(*args, **kwargs)
+ def __init__(self, hostname, ctx):
+ self._ctx = ctx
+ self._hostname = hostname
+ self._hostnameBytes = idna.encode(hostname)
+ ctx.set_info_callback(
+ _tolerateErrors(self._identityVerifyingInfoCallback)
+ )
- def do_nothing(*_args, **_kwargs):
- pass
+ def clientConnectionForTLS(self, tlsProtocol):
+ context = self._ctx
+ connection = SSL.Connection(context, None)
+ connection.set_app_data(tlsProtocol)
+ return connection
- self._ctx.set_info_callback(do_nothing)
+ def _identityVerifyingInfoCallback(self, connection, where, ret):
+ if where & SSL.SSL_CB_HANDSHAKE_START:
+ connection.set_tlsext_host_name(self._hostnameBytes)
class ClientTLSOptionsFactory(object):
@@ -70,13 +84,11 @@ class ClientTLSOptionsFactory(object):
to remote servers for federation."""
def __init__(self, config):
- self._ignore_certificate_validation = config.tls_ignore_certificate_validation
+ # We don't use config options yet
+ pass
def get_options(self, host):
- if self._ignore_certificate_validation:
- return ClientTLSOptionsNoCertVerification(
- unicode(host),
- OpenSSLCertificateOptions(verify=False).getContext()
- )
- else:
- return optionsForClientTLS(unicode(host))
+ return ClientTLSOptions(
+ unicode(host),
+ CertificateOptions(verify=False).getContext()
+ )
diff --git a/synapse/http/endpoint.py b/synapse/http/endpoint.py
index abf4862084..39432da452 100644
--- a/synapse/http/endpoint.py
+++ b/synapse/http/endpoint.py
@@ -65,7 +65,7 @@ def matrix_federation_endpoint(reactor, destination, tls_client_options_factory=
else:
def transport_endpoint(reactor, host, port, timeout):
return wrapClientTLS(
- tls_client_options_factory.get_options(unicode(host)),
+ tls_client_options_factory.get_options(host),
HostnameEndpoint(reactor, host, port, timeout=timeout))
default_port = 8448
|
