SNOW-3675579: verify TLS certificate hostname on every HTTPS connection

Author: sfc-gh-pczajka

DESCRIPTION.md

@@ -8,7 +8,7 @@ Source code is also available at: https://github.com/snowflakedb/snowflake-conne
 
 # Release Notes
 - v3.18.1(July 15,2026)
-  - N/A
+  - Improved verification of TLS connections (SNOW-3675579).
 
 - v3.18.0(October 03,2025)
   - Added support for pandas conversion for Day-time and Year-Month Interval types

src/snowflake/connector/ssl_wrap_socket.py

@@ -28,6 +28,7 @@
 from .vendored.urllib3 import connection as connection_
 from .vendored.urllib3.contrib.pyopenssl import PyOpenSSLContext, WrappedSocket
 from .vendored.urllib3.util import ssl_ as ssl_
+from .vendored.urllib3.util.ssl_match_hostname import CertificateError, match_hostname
 
 DEFAULT_OCSP_MODE: OCSPMode = OCSPMode.FAIL_OPEN
 FEATURE_OCSP_MODE: OCSPMode = DEFAULT_OCSP_MODE
@@ -76,13 +77,79 @@ def _ensure_partial_chain_on_context(ctx: PyOpenSSLContext, cafile: str | None)
         pass
 
 
-def _build_context_with_partial_chain(cafile: str | None) -> PyOpenSSLContext:
-    """Create PyOpenSSL context configured for CERT_REQUIRED and partial-chain trust."""
+def _nonnegative_options(value: int) -> int:
+    """Return *value* as the non-negative bitmask pyOpenSSL/cryptography expects.
+
+    ``ssl.SSLContext.options`` is exposed through a signed, platform-width C
+    ``long``. On Windows that type is 32 bits, so the common default mask (which
+    has bit 31 set, e.g. ``0x82520050``) is returned as a *negative* Python int.
+    cryptography's binding marshals the value into an unsigned parameter and
+    rejects negatives with ``OverflowError: can't convert negative number to
+    unsigned`` -- which previously aborted every Windows TLS handshake the
+    moment we carried these options onto the substituted ``PyOpenSSLContext``.
+    Recover the intended unsigned 32-bit mask; values that are already
+    non-negative (every other platform) pass through unchanged.
+    """
+    return value & 0xFFFFFFFF if value < 0 else value
+
+
+def _apply_stdlib_hardening(dst: PyOpenSSLContext, src: ssl.SSLContext | None) -> None:
+    """Carry TLS hardening from a stdlib ``SSLContext`` onto ``dst``.
+
+    The connector replaces the stdlib ``ssl.SSLContext`` that urllib3 builds
+    (or that a caller supplied) with a ``PyOpenSSLContext``. Without copying the
+    original context's hardening forward, the substitution silently drops the
+    TLS-version floor and ``OP_NO_*`` options urllib3 configured and
+    any hardening a caller set on a supplied context. Copy the
+    settings we can read back; fall back to urllib3's default floor when there
+    is no source context to mirror.
+
+    Limitation: cipher restrictions and pinned CA material (``cadata`` /
+    ``load_verify_locations``) cannot be read back out of an ``ssl.SSLContext``,
+    so they cannot be transferred here. Honoring caller-supplied pinning needs a
+    dedicated, supported channel and is tracked as a follow-up.
+    """
+    if isinstance(src, ssl.SSLContext):
+        # Mirror the protocol-version floor/ceiling and OpenSSL options the
+        # original context carried (e.g. TLS 1.2 minimum, OP_NO_SSLv3,
+        # OP_NO_COMPRESSION) plus any caller hardening (e.g. VERIFY_X509_STRICT).
+        for attr in ("minimum_version", "maximum_version", "verify_flags"):
+            try:
+                setattr(dst, attr, getattr(src, attr))
+            except (ValueError, OSError, OpenSSL.SSL.Error):
+                # Best-effort; an unsupported value must not break the handshake.
+                pass
+        try:
+            dst.options |= _nonnegative_options(src.options)
+        except (ValueError, OSError, OpenSSL.SSL.Error, OverflowError, TypeError):
+            # Best-effort; carrying options forward must never break the
+            # handshake even if a value can't be marshalled into pyOpenSSL.
+            pass
+    else:
+        # No source context to mirror (no ssl_context was supplied): restore the
+        # hardening urllib3's create_urllib3_context() would have applied.
+        try:
+            dst.minimum_version = ssl.TLSVersion.TLSv1_2
+            dst.options |= ssl.OP_NO_COMPRESSION
+        except (ValueError, OSError, OpenSSL.SSL.Error, OverflowError, TypeError):
+            pass
+
+
+def _build_context_with_partial_chain(
+    cafile: str | None, src_context: ssl.SSLContext | None = None
+) -> PyOpenSSLContext:
+    """Create PyOpenSSL context configured for CERT_REQUIRED and partial-chain trust.
+
+    When ``src_context`` is the stdlib context being replaced, its TLS hardening
+    (version floor, options, verify flags) is carried forward so the
+    substitution does not weaken the connection.
+    """
     ctx = PyOpenSSLContext(ssl_.PROTOCOL_TLS_CLIENT)
     try:
         ctx.verify_mode = ssl.CERT_REQUIRED
     except Exception:
         pass
+    _apply_stdlib_hardening(ctx, src_context)
     _ensure_partial_chain_on_context(ctx, cafile)
     return ctx
 
@@ -144,6 +211,54 @@ def inject_into_urllib3() -> None:
     connection_.ssl_wrap_socket = ssl_wrap_socket_with_ocsp
 
 
+def _verify_hostname_after_handshake(
+    wrapped_socket: WrappedSocket,
+    server_hostname: str | None,
+    ssl_context: Any,
+) -> None:
+    """Match the peer certificate against *server_hostname*."""
+    # Honor explicitly-disabled certificate verification (CERT_NONE) first; when
+    # verification is off there is nothing to assert about server identity, so a
+    # missing hostname is acceptable. Check this before the hostname so we only
+    # skip when the caller genuinely opted out of verification.
+    verify_mode = getattr(ssl_context, "verify_mode", ssl.CERT_REQUIRED)
+    if verify_mode == ssl.CERT_NONE:
+        return
+
+    # Verification is required but there is no host to match against (e.g. TLS
+    # without SNI). Fail closed rather than accepting the peer: without a
+    # hostname we cannot assert server identity.
+    if not server_hostname:
+        raise CertificateError(
+            "no server hostname supplied to match against the peer certificate; "
+            "cannot verify server identity"
+        )
+
+    # Normalize bracketed / scoped IPv6 literals the same way urllib3 does:
+    # strip the brackets and drop any "%scope" suffix before testing for an IP,
+    # since Python's ssl module treats scoped addresses as DNS hostnames.
+    normalized = server_hostname.strip("[]")
+    if "%" in normalized:
+        normalized = normalized[: normalized.rfind("%")]
+    if ssl_.is_ipaddress(normalized):
+        server_hostname = normalized
+
+    cert = wrapped_socket.getpeercert()
+    try:
+        match_hostname(cert, server_hostname)
+    except CertificateError as e:
+        log.warning(
+            "Certificate did not match expected hostname: %s. Certificate: %s",
+            server_hostname,
+            cert,
+        )
+        # Attach the cert so callers catching CertificateError can inspect it,
+        # matching urllib3's own _match_hostname behavior.
+        e._peer_cert = cert
+        wrapped_socket.close()
+        raise
+
+
 @wraps(ssl_.ssl_wrap_socket)
 def ssl_wrap_socket_with_ocsp(*args: Any, **kwargs: Any) -> WrappedSocket:
     # Bind passed args/kwargs to the underlying signature to support both positional and keyword calls
@@ -158,15 +273,21 @@ def ssl_wrap_socket_with_ocsp(*args: Any, **kwargs: Any) -> WrappedSocket:
 
     # Ensure PyOpenSSL context with partial-chain is used if none or wrong type provided
     provided_ctx = params.get("ssl_context")
+    cafile_for_ctx = _resolve_cafile(params)
     if not isinstance(provided_ctx, PyOpenSSLContext):
-        cafile_for_ctx = _resolve_cafile(params)
-        params["ssl_context"] = _build_context_with_partial_chain(cafile_for_ctx)
+        # Carry the replaced stdlib context's TLS hardening forward so the
+        # substitution doesn't silently weaken the connection.
+        params["ssl_context"] = _build_context_with_partial_chain(
+            cafile_for_ctx, src_context=provided_ctx
+        )
     else:
         # If a PyOpenSSLContext is provided, ensure it trusts the provided CA and partial-chain is enabled
-        _ensure_partial_chain_on_context(provided_ctx, _resolve_cafile(params))
+        _ensure_partial_chain_on_context(provided_ctx, cafile_for_ctx)
 
     ret = ssl_.ssl_wrap_socket(**params)
 
+    _verify_hostname_after_handshake(ret, server_hostname, params.get("ssl_context"))
+
     log.debug(
         "OCSP Mode: %s, OCSP response cache file name: %s",
         FEATURE_OCSP_MODE.name,

test/integ/test_connection.py

@@ -812,9 +812,13 @@ def test_invalid_connection_parameters_turned_off(conn_cnx):
             # TODO: SNOW-2114216 remove filtering once the root cause for deprecation warning is fixed
             # Filter out the deprecation warning
             filtered_w = [
-                warning for warning in w if warning.category != DeprecationWarning
+                warning
+                for warning in w
+                if str(warning.category).endswith("DeprecationWarning")
             ]
-            assert len(filtered_w) == 0
+            assert (
+                len(filtered_w) == 0
+            ), f"Unexpected warnings {[f.message for f in filtered_w]}"
 
 
 def test_invalid_connection_parameters_only_warns(conn_cnx):