mirrors/synapse
1
0
Fork 0
mirror of https://github.com/element-hq/synapse.git synced 2024-12-22 04:34:28 +03:00
Code Issues Projects Releases Packages Wiki Activity

Use platformTrust instead of verify=True

Browse source
This commit is contained in:
Andrew Morgan 2019-04-02 11:09:43 +01:00
parent fec0c9a074
commit aeffa4d84a
1 changed files with 7 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
synapse/crypto/context_factory.py
View file

@ -21,7 +21,7 @@ from OpenSSL import SSL, crypto
from twisted.internet._sslverify import _defaultCurveName from twisted.internet._sslverify import _defaultCurveName
from twisted.internet.abstract import isIPAddress, isIPv6Address from twisted.internet.abstract import isIPAddress, isIPv6Address
from twisted.internet.interfaces import IOpenSSLClientConnectionCreator from twisted.internet.interfaces import IOpenSSLClientConnectionCreator
from twisted.internet.ssl import CertificateOptions, ContextFactory from twisted.internet.ssl import CertificateOptions, ContextFactory, platformTrust
from twisted.python.failure import Failure from twisted.python.failure import Failure
logger = logging.getLogger(__name__) logger = logging.getLogger(__name__)
@ -132,14 +132,17 @@ class ClientTLSOptionsFactory(object):
# Check if we're using a custom list of a CA certificates # Check if we're using a custom list of a CA certificates
if config.federation_custom_ca_list is not None: if config.federation_custom_ca_list is not None:
self._options_validate = CertificateOptions( self._options_validate = CertificateOptions(
# This option implies verify=True # Use custom CA trusted root certs
trustRoot=config.federation_custom_ca_list, trustRoot=config.federation_custom_ca_list,
) )
else: else:
# If not, verify using those provided by the operating environment # If not, verify using those provided by the operating environment
self._options_validate = CertificateOptions(verify=True) self._options_validate = CertificateOptions(
# Use CA root certs provided by OpenSSL
trustRoot=platformTrust(),
)
self._options_novalidate = CertificateOptions(verify=False) self._options_novalidate = CertificateOptions()
def get_options(self, host): def get_options(self, host):
# Use _makeContext so that we get a fresh OpenSSL CTX each time. # Use _makeContext so that we get a fresh OpenSSL CTX each time.