Always verify certificate with CA

The fingerprint is no more used for certificate verification but only to
prevent fallback to plain http connection.
The system CA is used by default if no ca_certs is configured.

issue6270
review27991002

CHANGELOG

@@ -1,3 +1,4 @@
+* Verify certificate with default CA
 * Replace URL entry by a toolbar button
 
 Version 4.2.0 - 2016-11-28

doc/installation.rst

@@ -4,7 +4,7 @@ Installing tryton
 Prerequisites
 -------------
 
- * Python 2.7 or later (http://www.python.org/)
+ * Python 2.7.9 or later (http://www.python.org/)
  * gtk+ 2.6 or later and pygtk 2.22 or later (http://www.pygtk.org/)
  * gtk+ 3.20 or later and py-gobject3 (http://www.gtk.org/)
  * librsvg (http://librsvg.sourceforge.net/)

tryton/jsonrpc.py

@@ -181,8 +181,7 @@ class Transport(xmlrpclib.Transport, xmlrpclib.SafeTransport):
             return self._connection[1]
         host, self._extra_headers, x509 = self.get_host_info(host)
 
-        ca_certs = self.__ca_certs
-        cert_reqs = ssl.CERT_REQUIRED if ca_certs else ssl.CERT_NONE
+        ssl_ctx = ssl.create_default_context(cafile=self.__ca_certs)
 
         class HTTPSConnection(httplib.HTTPSConnection):
 
@@ -192,8 +191,8 @@ class Transport(xmlrpclib.Transport, xmlrpclib.SafeTransport):
                 if self._tunnel_host:
                     self.sock = sock
                     self._tunnel()
-                self.sock = ssl.wrap_socket(sock, self.key_file,
-                    self.cert_file, ca_certs=ca_certs, cert_reqs=cert_reqs)
+                self.sock = ssl_ctx.wrap_socket(
+                    sock, server_hostname=self.host)
 
         def http_connection():
             self._connection = host, httplib.HTTPConnection(host,
@@ -203,7 +202,7 @@ class Transport(xmlrpclib.Transport, xmlrpclib.SafeTransport):
             sock.setsockopt(socket.IPPROTO_TCP, socket.TCP_NODELAY, 1)
             sock.setsockopt(socket.SOL_SOCKET, socket.SO_KEEPALIVE, 1)
 
-        def https_connection():
+        def https_connection(allow_http=False):
             self._connection = host, HTTPSConnection(host,
                 timeout=CONNECT_TIMEOUT)
             try:
@@ -222,7 +221,10 @@ class Transport(xmlrpclib.Transport, xmlrpclib.SafeTransport):
                         enumerate(value), '')
                 return format_hash(hashlib.sha1(peercert).hexdigest())
             except ssl.SSLError:
-                http_connection()
+                if allow_http:
+                    http_connection()
+                else:
+                    raise
 
         fingerprint = ''
         if self.__fingerprints is not None and host in self.__fingerprints:
@@ -231,15 +233,10 @@ class Transport(xmlrpclib.Transport, xmlrpclib.SafeTransport):
             else:
                 http_connection()
         else:
-            fingerprint = https_connection()
+            fingerprint = https_connection(allow_http=True)
 
         if self.__fingerprints is not None:
-            if host in self.__fingerprints and self.__fingerprints[host]:
-                if self.__fingerprints[host] != fingerprint:
-                    self.close()
-                    raise ssl.SSLError('BadFingerprint')
-            else:
-                self.__fingerprints[host] = fingerprint
+            self.__fingerprints[host] = fingerprint
         self._connection[1].timeout = DEFAULT_TIMEOUT
         self._connection[1].sock.settimeout(DEFAULT_TIMEOUT)
         return self._connection[1]

tryton/rpc.py

@@ -3,6 +3,7 @@
 import httplib
 import logging
 import socket
+import ssl
 import os
 from functools import partial
 from tryton.jsonrpc import ServerProxy, ServerPool, Fault
@@ -57,7 +58,8 @@ def server_version(host, port):
         result = connection.common.server.version()
         logging.getLogger(__name__).debug(repr(result))
         return result
-    except (Fault, socket.error):
+    except (Fault, socket.error, ssl.SSLError, ssl.CertificateError), e:
+        logging.getLogger(__name__).error(e)
         return None