Skip to content
This repository has been archived by the owner on Feb 19, 2020. It is now read-only.

Fix hostname matching with user-provided certs #501

Open
wants to merge 1 commit into
base: develop
Choose a base branch
from

Conversation

lpsinger
Copy link

User-provided certs would cause XMLStream.start_tls to fail because the SSLContext object had check_hostname set, but no server_hostname was provided to SSLContext.wrap_socket. This would cause the connetion to fail and SleekXMPP to produce the following error message:

ERROR:sleekxmpp.basexmpp:check_hostname requires server_hostname
Traceback (most recent call last):
  File "/usr/lib/python3.7/site-packages/sleekxmpp/xmlstream/xmlstream.py", line 1568, in _process
    if not self.__read_xml():
  File "/usr/lib/python3.7/site-packages/sleekxmpp/xmlstream/xmlstream.py", line 1640, in __read_xml
    self.__spawn_event(xml)
  File "/usr/lib/python3.7/site-packages/sleekxmpp/xmlstream/xmlstream.py", line 1708, in __spawn_event
    handler.prerun(stanza_copy)
  File "/usr/lib/python3.7/site-packages/sleekxmpp/xmlstream/handler/callback.py", line 64, in prerun
    self.run(payload, True)
  File "/usr/lib/python3.7/site-packages/sleekxmpp/xmlstream/handler/callback.py", line 76, in run
    self._pointer(payload)
  File "/usr/lib/python3.7/site-packages/sleekxmpp/features/feature_starttls/starttls.py", line 64, in _handle_starttls_proceed
    if self.xmpp.start_tls():
  File "/usr/lib/python3.7/site-packages/sleekxmpp/xmlstream/xmlstream.py", line 940, in start_tls
    ssl_socket = self._create_secure_socket()
  File "/usr/lib/python3.7/site-packages/sleekxmpp/xmlstream/xmlstream.py", line 520, in _create_secure_socket
    return ctx.wrap_socket(self.socket, do_handshake_on_connect=False)
  File "/usr/lib/python3.7/ssl.py", line 412, in wrap_socket
    session=session
  File "/usr/lib/python3.7/ssl.py", line 810, in _create
    raise ValueError("check_hostname requires server_hostname")
ValueError: check_hostname requires server_hostname

Fix this by passing the hostname, which fortunately had been saved in XMLStream._expected_server_name.

User-provided certs would cause `XMLStream.start_tls` to fail
because the `SSLContext` object had `check_hostname` set, but
no `server_hostname` was provided to `SSLContext.wrap_socket`.
This would cause the connetion to fail and SleekXMPP to produce
the following error message:

    ERROR:sleekxmpp.basexmpp:check_hostname requires server_hostname
    Traceback (most recent call last):
      File "/usr/lib/python3.7/site-packages/sleekxmpp/xmlstream/xmlstream.py", line 1568, in _process
        if not self.__read_xml():
      File "/usr/lib/python3.7/site-packages/sleekxmpp/xmlstream/xmlstream.py", line 1640, in __read_xml
        self.__spawn_event(xml)
      File "/usr/lib/python3.7/site-packages/sleekxmpp/xmlstream/xmlstream.py", line 1708, in __spawn_event
        handler.prerun(stanza_copy)
      File "/usr/lib/python3.7/site-packages/sleekxmpp/xmlstream/handler/callback.py", line 64, in prerun
        self.run(payload, True)
      File "/usr/lib/python3.7/site-packages/sleekxmpp/xmlstream/handler/callback.py", line 76, in run
        self._pointer(payload)
      File "/usr/lib/python3.7/site-packages/sleekxmpp/features/feature_starttls/starttls.py", line 64, in _handle_starttls_proceed
        if self.xmpp.start_tls():
      File "/usr/lib/python3.7/site-packages/sleekxmpp/xmlstream/xmlstream.py", line 940, in start_tls
        ssl_socket = self._create_secure_socket()
      File "/usr/lib/python3.7/site-packages/sleekxmpp/xmlstream/xmlstream.py", line 520, in _create_secure_socket
        return ctx.wrap_socket(self.socket, do_handshake_on_connect=False)
      File "/usr/lib/python3.7/ssl.py", line 412, in wrap_socket
        session=session
      File "/usr/lib/python3.7/ssl.py", line 810, in _create
        raise ValueError("check_hostname requires server_hostname")
    ValueError: check_hostname requires server_hostname

Fix this by passing the hostname, which fortunately had been
saved in `XMLStream._expected_server_name`.
@lpsinger
Copy link
Author

Ping!

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant