Added support for ssl fingerprint validation.

- Issue #333
- Needed to patch urrlib3 for older requests versions
- Use --leap-cert-fingerprint <SHA1> to validate fingerprint

2 files changed, 126 insertions, 0 deletions

diff --git a/service/pixelated/support/ext_requests_urllib3.py b/service/pixelated/support/ext_requests_urllib3.py
new file mode 100644
index 00000000..a836d6fd
--- /dev/null
+++ b/service/pixelated/support/ext_requests_urllib3.py
@@ -0,0 +1,79 @@
+#
+# Copyright (c) 2014 ThoughtWorks, Inc.
+#
+# Pixelated is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# Pixelated is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with Pixelated. If not, see <http://www.gnu.org/licenses/>.
+
+import requests
+import requests.packages.urllib3.connectionpool
+from socket import error as SocketError, timeout as SocketTimeout
+from requests.packages.urllib3.packages.ssl_match_hostname import CertificateError, match_hostname
+import socket
+import ssl
+
+from requests.packages.urllib3.exceptions import (
+    ClosedPoolError,
+    ConnectTimeoutError,
+    EmptyPoolError,
+    HostChangedError,
+    MaxRetryError,
+    SSLError,
+    ReadTimeoutError,
+    ProxyError,
+)
+
+from requests.packages.urllib3.util import (
+    assert_fingerprint,
+    get_host,
+    is_connection_dropped,
+    resolve_cert_reqs,
+    resolve_ssl_version,
+    ssl_wrap_socket,
+    Timeout,
+)
+
+
+def patched_connect(self):
+    # Add certificate verification
+    try:
+        sock = socket.create_connection(address=(self.host, self.port), timeout=self.timeout)
+    except SocketTimeout:
+        raise ConnectTimeoutError(self, "Connection to %s timed out. (connect timeout=%s)" % (self.host, self.timeout))
+
+    resolved_cert_reqs = resolve_cert_reqs(self.cert_reqs)
+    resolved_ssl_version = resolve_ssl_version(self.ssl_version)
+
+    if self._tunnel_host:
+        self.sock = sock
+        # Calls self._set_hostport(), so self.host is
+        # self._tunnel_host below.
+        self._tunnel()
+
+    # Wrap socket using verification with the root certs in
+    # trusted_root_certs
+    self.sock = ssl_wrap_socket(sock, self.key_file, self.cert_file,
+                                cert_reqs=resolved_cert_reqs,
+                                ca_certs=self.ca_certs,
+                                server_hostname=self.host,
+                                ssl_version=resolved_ssl_version)
+
+    if self.assert_fingerprint:
+        assert_fingerprint(self.sock.getpeercert(binary_form=True),
+                           self.assert_fingerprint)
+    elif resolved_cert_reqs != ssl.CERT_NONE and self.assert_hostname is not False:
+        match_hostname(self.sock.getpeercert(),
+                       self.assert_hostname or self.host)
+
+
+if requests.__version__ == '2.0.0':
+    requests.packages.urllib3.connectionpool.VerifiedHTTPSConnection.connect = patched_connect
diff --git a/service/pixelated/support/tls_adapter.py b/service/pixelated/support/tls_adapter.py
new file mode 100644
index 00000000..f543bf4d
--- /dev/null
+++ b/service/pixelated/support/tls_adapter.py
@@ -0,0 +1,47 @@
+#
+# Copyright (c) 2014 ThoughtWorks, Inc.
+#
+# Pixelated is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# Pixelated is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with Pixelated. If not, see <http://www.gnu.org/licenses/>.
+
+import ssl
+from requests.adapters import HTTPAdapter
+try:
+    from urllib3.poolmanager import PoolManager
+except:
+    from requests.packages.urllib3.poolmanager import PoolManager
+
+VERIFY_HOSTNAME = None
+
+
+def latest_available_ssl_version():
+    try:
+        return ssl.PROTOCOL_TLSv1_2
+    except AttributeError:
+        return ssl.PROTOCOL_TLSv1
+
+
+class EnforceTLSv1Adapter(HTTPAdapter):
+    __slots__ = ('_assert_hostname', '_assert_fingerprint')
+
+    def __init__(self, assert_hostname=VERIFY_HOSTNAME, assert_fingerprint=None):
+        self._assert_hostname = assert_hostname
+        self._assert_fingerprint = assert_fingerprint
+        super(EnforceTLSv1Adapter, self).__init__()
+
+    def init_poolmanager(self, connections, maxsize, block=False):
+        self.poolmanager = PoolManager(num_pools=connections, maxsize=maxsize,
+                                       block=block, ssl_version=latest_available_ssl_version(),
+                                       assert_hostname=self._assert_hostname,
+                                       assert_fingerprint=self._assert_fingerprint,
+                                       cert_reqs=ssl.CERT_REQUIRED)