Skip to content

Commit 23cbf90

Browse files
aboudreaultaboudreault
authored
PYTHON_1186: Connection fails to validate ssl certificate hostname when SSLContext.check_hostname is set (apache#1059)
* Fix Connection fails to validate ssl certificate hostname when SSLContext.check_hostname is set
1 parent 2cdb75c commit 23cbf90

17 files changed

Lines changed: 176 additions & 117 deletions

‎CHANGELOG.rst‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ Features
1111
Bug Fixes
1212
---------
1313
* re-raising the CQLEngineException will fail on Python 3 (PYTHON-1166)
14+
* Connection fails to validate ssl certificate hostname when SSLContext.check_hostname is set
1415

1516
3.20.2
1617
======

‎cassandra/connection.py‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -616,7 +616,14 @@ def factory(cls, endpoint, timeout, *args, **kwargs):
616616
return conn
617617

618618
def _wrap_socket_from_context(self):
619-
self._socket = self.ssl_context.wrap_socket(self._socket, **(self.ssl_options or {}))
619+
ssl_options = self.ssl_options or {}
620+
# PYTHON-1186: set the server_hostname only if the SSLContext has
621+
# check_hostname enabled and it is not already provided by the EndPoint ssl options
622+
if (self.ssl_context.check_hostname and
623+
'server_hostname' not in ssl_options):
624+
ssl_options = ssl_options.copy()
625+
ssl_options['server_hostname'] = self.endpoint.address
626+
self._socket = self.ssl_context.wrap_socket(self._socket, **ssl_options)
620627

621628
def _initiate_connection(self, sockaddr):
622629
self._socket.connect(sockaddr)

‎docs/security.rst‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,14 @@ To enable SSL with version 3.17.0 and higher, you will need to set :attr:`.Clust
6969
to a dict of options. These will be passed as kwargs to ``ssl.SSLContext.wrap_socket()``
7070
when new sockets are created.
7171

72+
If you create your SSLContext using `ssl.create_default_context <https://docs.python.org/3/library/ssl.html#ssl.create_default_context>`_,
73+
be aware that SSLContext.check_hostname is set to True by default, so the hostname validation will be done
74+
by Python and not the driver. For this reason, we need to set the server_hostname at best effort, which is the
75+
resolved ip address. If this validation needs to be done against the FQDN, consider enabling it using the ssl_options
76+
as described in the following examples or implement your own :class:`~.connection.EndPoint` and
77+
:class:`~.connection.EndPointFactory`.
78+
79+
7280
The following examples assume you have generated your Cassandra certificate and
7381
keystore files with these intructions:
7482

‎tests/integration/long/ssl/.keystore‎

-2.23 KB
Binary file not shown.

‎tests/integration/long/ssl/127.0.0.1.keystore‎

4.22 KB
Binary file not shown.

‎tests/integration/long/ssl/cassandra.pem‎

Lines changed: 0 additions & 19 deletions
This file was deleted.

‎tests/integration/long/ssl/cassandra.truststore‎

1.05 KB
Binary file not shown.

‎tests/integration/long/ssl/client.crt_signed‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIDCzCCAfMCFHXm/9f6KJL3965bBgZMFdd4Xs0gMA0GCSqGSIb3DQEBCwUAMEIx
3+
CzAJBgNVBAYTAlVTMREwDwYDVQQKDAhkYXRhc3RheDEPMA0GA1UECwwGZmllbGRz
4+
MQ8wDQYDVQQDDAZyb290Q2EwHhcNMTkxMTI3MTk1ODA3WhcNMjAxMTI2MTk1ODA3
5+
WjBCMQswCQYDVQQGEwJVUzERMA8GA1UECgwIZGF0YXN0YXgxDzANBgNVBAsMBmZp
6+
ZWxkczEPMA0GA1UEAwwGY2xpZW50MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
7+
CgKCAQEA4SEvwK9IbwdVEnBEf6UbYyaGh0Ao4VGyIA2Z2yDTmSIqBgBZjbBdYr1w
8+
FC0nMqKgAI0NOqZHNRiuOUojweHZLwrYhVPg2e/Va+vGslQY+cKmAYDTCsxhEwv7
9+
4PXiI6QhGwmfhnSnA0+nzPKZU1SFFWl9Od07X8QJWJMLHDOG14OnsWI2t4wetkIw
10+
6yyTXfyAD9mSsQeqyu5P6E94E2VAGtQvP4yeAJX/dWPYhFEBctsQ0H+Jk2GK3kBe
11+
9YX9Jhk4Ono8cdUy3WfUFQRXgi01YmF1vI+Z0fS0olkdqw8mDonFpMS0ly97Lnze
12+
aOsTv3s/SONdYa3BslbEAwUT7kvE4QIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQAH
13+
QZDTPBQgMbTCp8IJvDRbXKQAfjEE7FjYani1qWOMx5JpOJIoYHnnbLNRxCWowWRj
14+
zsyOa5Sqs0TVOS5/4QHqu+cSdZsUNL9TvESor+BwgSf81JViD0r//xK+j58pLqB1
15+
F+sPIltIqclWRN/QZH1VNZ+G0WQiXoT+YGNYRzJtXNBQAi3cxZSXLaeZ6yViWzw3
16+
m8IL0nUTX+uNxJSaFqZw1vTHBe0hC/l+P3YfnM1k6lg4lsWDvzdwNKfmohFlo5eV
17+
OSG89YncwigG1KUHfQ1ECX7aaI8+cTFEg5XWTMqwVko1pRVVL9mVF/YEwI/+ydaJ
18+
whmL77CEP1AvHIjdiafh
19+
-----END CERTIFICATE-----

‎tests/integration/long/ssl/client.key‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
-----BEGIN PRIVATE KEY-----
2+
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDhIS/Ar0hvB1US
3+
cER/pRtjJoaHQCjhUbIgDZnbINOZIioGAFmNsF1ivXAULScyoqAAjQ06pkc1GK45
4+
SiPB4dkvCtiFU+DZ79Vr68ayVBj5wqYBgNMKzGETC/vg9eIjpCEbCZ+GdKcDT6fM
5+
8plTVIUVaX053TtfxAlYkwscM4bXg6exYja3jB62QjDrLJNd/IAP2ZKxB6rK7k/o
6+
T3gTZUAa1C8/jJ4Alf91Y9iEUQFy2xDQf4mTYYreQF71hf0mGTg6ejxx1TLdZ9QV
7+
BFeCLTViYXW8j5nR9LSiWR2rDyYOicWkxLSXL3sufN5o6xO/ez9I411hrcGyVsQD
8+
BRPuS8ThAgMBAAECggEBAN6HezgvCp4U1VZgepThkuyyzA8ssDvoEPX1+7rJ+95G
9+
EtvTxLF1Pxm2vu5yo2g9r4Jb6lOqwIAPYUdnrWib4Z3KTrObcYp6sq72Y3UqA3X9
10+
nTGnMPRfiSTWl6aJ5XntZnvfSzwQWnW/atH+iuf/h3zexNVJhMLod4SB9F1v4T1s
11+
HgVjDJ/4cLomtNDkB0CwhgNr6elASL/DLnWC4Fb+C7HpJtu4A4U/08DWD6kAfs5a
12+
zaSTywXVtxpp4NSMJUUI6KQZEfA4uLP8dLX5QMYgdwfpKXkVturTWMIUmU73IWCk
13+
CaDMdXNeKU7d2iJIQi3DlHrcVZm+MaQKW79N5XUo3TECgYEA/u28rQM7AAWNNEJI
14+
Gj/iGGFF6lE2V+o2uWySxEZeb0noWzuyUP2bKU+CbYhaS6YCAtEEkLCHSt6D4jZs
15+
vUxJTz3H99F4jqLbI0iZE+TKh0ff0oVDq8odmn03QylbZ3+H0xgfumjyOtQ9/CKs
16+
1fIA7pXXu0M2J7znYes/tUsINs8CgYEA4hNj9gk2xCrKE/onmzodWa1F4VrsrajC
17+
aDZmm7P+gZb/7p2JRn54K0SWSJthVNu3WnnzNFjR4lsRN7jVxscWb5Uq0ppYNjj6
18+
5Y3IU7F8zhib1zaasqPpvZpq2rK0AwFeQN8aZrLhWEPVii30HnLc9cQRFcHiZfWj
19+
/amGJzB2NU8CgYAs1Jf6gPfuMAu95e4SF6vmB60o4LFC0qBfCVXiCFHxFjkzWhMo
20+
pQCVSjMwmervJLlzz1gTLcgNBYaB0Hpc6750nfO9g+vEgaUx1kF9Ox3WnnAg8GiP
21+
HFMKaPy/5dT6JXY4TCTAPlZivBJOdbaZRR6e1mECwHYUlObH1Hv2oMRIBwKBgHzW
22+
UkOBMQG/0xiW8RnxTFXBra3URI9cegWLzLs7+FTc6fR8f1oy6e6SkB4F1whBz4yh
23+
fJ+yUCubN/W6FioOs5/oEd57pixC6KCr2ywD/TPdOOjtWR0+EAtH4qtjNK3YKpDN
24+
4clGC9NumdMUrxHFQahgnUKTbo34x5aB7vdi9lNXAoGBAJrYYiVUe46FDAGZUzKG
25+
xMuJS693kx23vC/PNaIP9wMa58aOEtTw+zLdyioiQIvxmJXTnEKWFK25z0n0gDJM
26+
hMar/CFrERHooWRjn+a5kyKXppJ1DHtoSho67wOjejsnikjQvmppEBFr1YjvyDhD
27+
kY44x2EM9WzqlrwHtBeblQWE
28+
-----END PRIVATE KEY-----

‎tests/integration/long/ssl/client_bad.key‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
-----BEGIN PRIVATE KEY-----
2+
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDha8+NBvpTmTbw
3+
D2EIodXlaaAEtLmXTGoH8pdBm3JxzMuUEkYbGig3YjQ1BAKQgCB1TJGPINcHz7Jo
4+
5aW5To1jrxhhohZYQLCNKlAONDhgJbHEPf7s8dreQ/q5ISt/2I3z68c9I0j3VoRz
5+
AxxcNktl/x+6YkXe9tXf/LWmJk/gHlu72/HuJ5oNyqOKaCCoMoib3jLTlR+lslTy
6+
Qy/CJZH6WJabLOPmppFLaxJMlSGDSTE/Xktt7+H5ssHnfQtyWyylVjZkzChJfBgh
7+
HrLpm3hO5rmqVwOhoKLKVDFMmX3aMGX2S+3KpXQ8gLnPXwfLI9J9fDg5jp7bya4k
8+
OXlZfB5hAgMBAAECggEBANQVFbmudfgPL4PeREHV2SM1JCspSW9SonOFxs8gDCWL
9+
M4HFS5YWHv40c7/pXOxMz7zsZApQMF8WBtnwLeJRSG8f/oVk9Tbk7fZyd81VTjEP
10+
ZdenKGAPEAeL16kzzvRCbxOtoc8gkna6PHTk2VrcbkWxKU23RduHSiOpY9HFO+Mz
11+
iI69tB7657NOiZCQ6xDIjKv+jR63m7VAWKT5jkN+tYpvx4K20na5t8RO1s0shqNE
12+
e2zMG8WXVl6lW4btfkt/lwWUNXu8olMTk9qN2b5Rq7BEJfKwn3lb9vCpUMyewtRB
13+
/8U+Zu7Tlwni5QagOqAUEkjuOJ8cR/Jgwu1mqV2sXxECgYEA9zXi0PjWAe2ZIALd
14+
1iWPZCvvT7yEjt4ulhAYPqi8T38B4K5f//m5SuYPS2ebmSAd2WBTeIX2A6mHc9lk
15+
53gnwvsgAqaFgjYeDqBThpCE8icFXEZnJbtnJyC8zC7pYjUovAHkFEdLw5kQoI6Y
16+
i9HNOS9ugSut8RnF0oSv/E2mahUCgYEA6W+ZAEneBBCsOQclVfVPLm7D+y+5SZEt
17+
zWr2b7CCnGCev/qRCllIEwQ2+W1ACEHof9xjE+aWwEQjX8YnoVbAJo2ru6FFQfI+
18+
f/SQx7beX8jUAeJGo+CFr2ijdVmcCCbMGeAm8mpACUIQfWPHVqjtGS/CayxdfwA+
19+
lbWPbkXCMh0CgYBfUgHRPgGW4LyoYTKUfgsaPu6ZukEKrZUc+7u9fWaO6JQaxGHz
20+
26CcxrSjCKIwmvend8L3t/+yTc4S14JW1jfOsPIY04irOp7AWQWb32HD1VP1zpe7
21+
LtWJetARkw0edwzr4XbGcu89zmlg31rmntEY+bcMS4FYc+2ZTNxm1rISOQKBgGQZ
22+
lct44Xpux9tghBMbMUwg9WtWKKcyWSi4EFsOnsN97zU1tlJwvKZi7UwCHC4uTQvf
23+
LqFPBSAHV//u0fmuYJFnuNeprTA9N63Y6uipMyxxyu/P3yjQ06LHRSjCN1WLhYQn
24+
Cax0AWe266lJSyaPI7TkNQOOL72RFkVOaOYJhd/FAoGAPtpVPTiVK0RYwLnZqaWB
25+
fxyI6w+UjOEbP88vD7N7FEI2kQSGQ6F3pMzDK37NglJVtwjgzEIF9x9BIE8XSf16
26+
shc0U73Vg9ZsXDNPUz21hhAwYL1cCgnx0mfL88F1Icb5FfxlT/1BPHNHKowA9vST
27+
ihbxCJg/JJBzwXTxPocQisk=
28+
-----END PRIVATE KEY-----

0 commit comments

Comments
 (0)