Mikaela/Limnoria
1
0
Fork 0
mirror of https://github.com/Mikaela/Limnoria.git synced 2024-11-23 19:19:32 +01:00
Code Issues Projects Releases Wiki Activity

Disable SSL cert verification by default.

Browse Source 
Having it enabled by default would break existing bots just by
doing the update.
Let's just show a warning and give owners some time to update
their config, for the moment.
This commit is contained in:
Valentin Lorentz 2016-02-21 14:47:44 +01:00
parent ae560dbd2a
commit a7096f8b3e
2 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/conf.py
View File

@ -1175,7 +1175,7 @@ utils.web.proxy = supybot.protocols.http.proxy
### ###
registerGroup(supybot.protocols, 'ssl') registerGroup(supybot.protocols, 'ssl')
registerGlobalValue(supybot.protocols.ssl, 'verifyCertificates', registerGlobalValue(supybot.protocols.ssl, 'verifyCertificates',
registry.Boolean(True, _("""Determines whether server certificates registry.Boolean(False, _("""Determines whether server certificates
will be verified. Valid values are "required", "optional", and "none". will be verified. Valid values are "required", "optional", and "none".
The default and recommended setting is "required", which checks the The default and recommended setting is "required", which checks the
server certificate is signed by a known Certificate Authority, and server certificate is signed by a known Certificate Authority, and

8
src/drivers/Socket.py
View File

@ -361,11 +361,17 @@ class SocketDriver(drivers.IrcDriver, drivers.ServersMixin):
drivers.log.warning('Could not find cert file %s.' % drivers.log.warning('Could not find cert file %s.' %
certfile) certfile)
certfile = None certfile = None
verifyCertificates = conf.supybot.protocols.ssl.verifyCertificates()
if not verifyCertificates:
drivers.log.warning('Not checking SSL certificates, connections '
'are vulnerable to man-in-the-middle attacks. Set '
'supybot.protocols.ssl.verifyCertificates to "true" '
'to enable validity checks.')
try: try:
self.conn = utils.net.ssl_wrap_socket(self.conn, self.conn = utils.net.ssl_wrap_socket(self.conn,
logger=drivers.log, hostname=self.server[0], logger=drivers.log, hostname=self.server[0],
certfile=certfile, certfile=certfile,
verify=conf.supybot.protocols.ssl.verifyCertificates(), verify=verifyCertificates,
trusted_fingerprints=network_config.ssl.serverFingerprints(), trusted_fingerprints=network_config.ssl.serverFingerprints(),
) )
except ssl.CertificateError as e: except ssl.CertificateError as e: