Add proper SSL and IPv6 support

Bug #1051187 reported by Jason Gerard DeRose
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Microfiber
Fix Released
High
Jason Gerard DeRose

Bug Description

Although Microfiber can already make requests to HTTPS URLs, it doesn't verify the server cert, and it doesn't have all the flexibility we need.

So we're now going to create a proper SSLContext for HTTPS URLs and use CERT_REQUIRED for the verify_mode.

And I'm extending the *env* API to allow you to also:

 * provide a custom ca_file and/or ca_path for verifying the server cert (otherwise the openssl default will be used)

 * provide a client cert (and client key if the cert doesn't contain the key)

 * turn off host-name verification (needed for dynamic stuff with Avahi on the localnetwork)

As far as IPv6, Microfiber already supports it perfectly (as far as I can tell). But we don't have unit tests or documentation for IPv6 cases, so I'm working on that.

There is a similar bug in UserCouch, which will need to land first:

https://bugs.launchpad.net/usercouch/+bug/1050575

I'm going back and forth between these two bugs right now in order to get the design of the *env* extension right. What I'm thinking of is an optional 'ssl' sub-dictionary something like this:

env = {
    'url': 'https://127.0.0.1:6984/',
    'ssl': {
        'ca_file': <filename>,
        'ca_path': <dirname>,
        'cert_file': <filename>,
        'key_file': <filename>,
        'check_hostname': False,
    }
}

Everything in env['ssl'] is optional, although providing the 'key_file' doesn't make sense unless you also provide 'cert_file'.

Also, env['ssl'] only has any effect when env['url'] is an https:// URL.

Tags: ipv6 ssl

Related branches

Changed in microfiber:
status: In Progress → Fix Committed
Changed in microfiber:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.