connection: fail closed on pyopenssl verification

Author: dkropachev

CHANGELOG.rst

@@ -1,6 +1,18 @@
 Unreleased
 ==========
 
+Bug Fixes
+---------
+* Explicit ``ssl_options={}`` and endpoint SSL options now enable TLS instead
+  of being treated as omitted SSL options. An empty dict encrypts the
+  connection without server certificate verification unless verification
+  options such as ``ca_certs`` or ``cert_reqs`` are supplied.
+* Legacy ``ssl_options`` now work with the Twisted and Eventlet reactors by
+  using pyOpenSSL contexts with mapped protocol, verification, cipher, SNI, and
+  hostname-validation settings.
+* ``SSLContext`` setup now applies ``cert_reqs`` through ``verify_mode`` instead
+  of overwriting the SSL options bitmask, preserving default hardening flags.
+
 Others
 ------
 * Message serialization now receives the connection's negotiated ``ProtocolFeatures``:

cassandra/cluster.py

@@ -885,6 +885,15 @@ def default_retry_policy(self, policy):
 
     The following documentation only applies when ssl_options is used without ssl_context.
 
+    .. versionchanged:: 3.29.12
+
+    An explicit empty dict (``ssl_options={}``) enables TLS with default
+    options, while ``ssl_options=None`` leaves the connection in plaintext.
+    Empty options do not supply ``ca_certs`` or ``cert_reqs``, so the
+    encrypted connection does not verify the server certificate. Supply
+    ``ca_certs`` and, when needed, ``'check_hostname': True`` to authenticate
+    the server.
+
     By default, a ``ca_certs`` value should be supplied (the value should be
     a string pointing to the location of the CA certs file), and you probably
     want to specify ``ssl_version`` as ``ssl.PROTOCOL_TLS`` to match

cassandra/connection.py

@@ -168,8 +168,6 @@ def _pyopenssl_ssl_method_from_stdlib(ssl_module, ssl_version):
 def _pyopenssl_verify_mode_from_cert_reqs(ssl_module, cert_reqs):
     if cert_reqs is None:
         return None
-    if cert_reqs.__class__ is not type(ssl.CERT_REQUIRED):
-        return cert_reqs
     if cert_reqs == ssl.CERT_NONE:
         return ssl_module.VERIFY_NONE
     if cert_reqs in (ssl.CERT_OPTIONAL, ssl.CERT_REQUIRED):
@@ -293,6 +291,10 @@ def _pyopenssl_cert_common_names(cert):
 
 
 def _validate_pyopenssl_hostname(cert, hostname):
+    if cert is None:
+        raise ssl.CertificateError(
+            "peer did not present a certificate; cannot verify hostname %r" % (hostname,))
+
     san_dns_names, san_ip_addresses = _pyopenssl_cert_subject_alt_names(cert)
     san_names = san_dns_names + san_ip_addresses
     hostname_is_ip = _is_ip_address(hostname)

cassandra/io/eventletreactor.py

@@ -20,10 +20,11 @@
 from eventlet.queue import Queue
 from greenlet import GreenletExit
 import logging
+import ssl
 from threading import Event
 import time
 
-from cassandra.connection import (Connection, ConnectionShutdown, Timer, TimerManager,
+from cassandra.connection import (Connection, ConnectionException, ConnectionShutdown, Timer, TimerManager,
                                   _build_pyopenssl_context_from_options as _build_pyopenssl_context,
                                   _default_pyopenssl_ssl_method,
                                   _ensure_pyopenssl_context_requires_verification,
@@ -132,7 +133,11 @@ def _initiate_connection(self, sockaddr):
 
     def _validate_hostname(self):
         expected_name = (self.ssl_options or {}).get('server_hostname') or self.endpoint.address
-        _validate_pyopenssl_hostname(self._socket.get_peer_certificate(), expected_name)
+        try:
+            _validate_pyopenssl_hostname(self._socket.get_peer_certificate(), expected_name)
+        except ssl.CertificateError as exc:
+            raise ConnectionException(
+                "Hostname verification failed: %s" % (exc,), self.endpoint) from exc
 
     def _build_ssl_context_from_options(self):
         _check_pyopenssl()

cassandra/io/twistedreactor.py

@@ -189,15 +189,19 @@ def verify_callback(self, connection, x509, errnum, errdepth, ok):
 
     @staticmethod
     def info_callback(connection, where, ret):
-        if where & SSL.SSL_CB_HANDSHAKE_DONE:
-            tls_protocol = connection.get_app_data()
-            app_data = getattr(tls_protocol, _TLS_APP_DATA_ATTR, None)
-            if app_data and app_data.check_hostname:
-                try:
-                    _validate_pyopenssl_hostname(connection.get_peer_certificate(), app_data.expected_name)
-                except ssl.CertificateError as exc:
-                    tls_protocol.failVerification(
-                        Failure(ConnectionException(str(exc), app_data.endpoint)))
+        if not where & SSL.SSL_CB_HANDSHAKE_DONE:
+            return
+        tls_protocol = connection.get_app_data()
+        app_data = getattr(tls_protocol, _TLS_APP_DATA_ATTR, None)
+        if not (app_data and app_data.check_hostname):
+            return
+        try:
+            _validate_pyopenssl_hostname(
+                connection.get_peer_certificate(), app_data.expected_name)
+        except Exception as exc:
+            tls_protocol.failVerification(
+                Failure(ConnectionException(
+                    "Hostname verification failed: %s" % (exc,), app_data.endpoint)))
 
     def clientConnectionForTLS(self, tlsProtocol):
         connection = SSL.Connection(self.context, None)

tests/unit/io/test_eventletreactor.py

@@ -31,7 +31,7 @@
     eventletreactor = None
     EventletConnection = None  # noqa
 
-from cassandra.connection import Connection, DefaultEndPoint
+from cassandra.connection import Connection, ConnectionException, DefaultEndPoint
 
 CA_CERTS = os.path.abspath(os.path.join(
     os.path.dirname(__file__), '..', '..', 'integration', 'long', 'ssl', 'rootCa.crt'))
@@ -205,7 +205,7 @@ def test_validate_hostname_prefers_san_over_common_name(self):
         conn._socket.get_peer_certificate.return_value = _make_certificate(
             'node.example.com', san_dns_names=['other.example.com'])
 
-        with self.assertRaises(ssl.CertificateError):
+        with self.assertRaises(ConnectionException):
             conn._validate_hostname()
 
 

tests/unit/io/test_twistedreactor.py

@@ -18,7 +18,7 @@
 from types import SimpleNamespace
 from unittest.mock import Mock, patch
 
-from cassandra.connection import Connection, DefaultEndPoint
+from cassandra.connection import Connection, ConnectionException, DefaultEndPoint
 
 try:
     from twisted.test import proto_helpers
@@ -235,6 +235,24 @@ def set_tlsext_host_name(self, server_hostname):
         validate_hostname.assert_called_once_with(
             first_connection.peer_cert, 'node1.example.com')
 
+    def test_info_callback_fails_closed_on_unexpected_exception(self):
+        connection = Mock()
+        tls_protocol = Mock()
+        setattr(tls_protocol, twistedreactor._TLS_APP_DATA_ATTR,
+                twistedreactor._TLSAppData(
+                    DefaultEndPoint('node.example.com'), 'node.example.com', True))
+        connection.get_app_data.return_value = tls_protocol
+        connection.get_peer_certificate.return_value = object()
+
+        with patch.object(twistedreactor, '_validate_pyopenssl_hostname',
+                          side_effect=RuntimeError('boom')):
+            twistedreactor._SSLCreator.info_callback(
+                connection, twistedreactor.SSL.SSL_CB_HANDSHAKE_DONE, 1)
+
+        failure = tls_protocol.failVerification.call_args[0][0]
+        assert isinstance(failure.value, ConnectionException)
+        assert "Hostname verification failed" in str(failure.value)
+
 
 class TestTwistedTimer(TimerTestMixin, unittest.TestCase):
     """

tests/unit/test_connection.py

@@ -126,6 +126,10 @@ def test_ip_hostname_accepts_exact_common_name_without_san(self):
 
         _validate_pyopenssl_hostname(cert, '1.2.3.4')
 
+    def test_rejects_missing_certificate(self):
+        with self.assertRaises(ssl.CertificateError):
+            _validate_pyopenssl_hostname(None, 'node.example.com')
+
 
 class PyOpenSSLContextTest(unittest.TestCase):
 
@@ -148,6 +152,13 @@ def test_check_hostname_promotes_verify_none_to_verify_peer(self):
 
         assert context.verify_mode == FakePyOpenSSLModule.VERIFY_PEER
 
+    def test_plain_int_cert_reqs_option_is_translated(self):
+        context = _build_pyopenssl_context_from_options(
+            FakePyOpenSSLModule,
+            {'cert_reqs': int(ssl.CERT_REQUIRED)})
+
+        assert context.verify_mode == FakePyOpenSSLModule.VERIFY_PEER
+
     def test_supplied_context_check_hostname_promotes_verify_none_to_verify_peer(self):
         context = FakePyOpenSSLContext(FakePyOpenSSLModule.TLS_CLIENT_METHOD)
         context.verify_mode = FakePyOpenSSLModule.VERIFY_NONE