Page MenuHomePhorge
Files F85829479

No OneTemporary
Actions

Authored By
Unknown
Size
6 KB
Referenced Files
None
Subscribers
None

View Options

diff --git a/lib/pleroma/http/tls.ex b/lib/pleroma/http/tls.ex
index e1fbc7caa..bb90f8e4e 100644
--- a/lib/pleroma/http/tls.ex
+++ b/lib/pleroma/http/tls.ex
@@ -1,41 +1,49 @@
# Pleroma: A lightweight social networking server
# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
# SPDX-License-Identifier: AGPL-3.0-only
defmodule Pleroma.HTTP.TLS do
@moduledoc """
TLS client options that trust the CAStore bundle.
Hackney otherwise trusts its own certifi bundle. Hackney 1 drops all of its
default TLS options, including certificate checks, as soon as any
`ssl_options` are given. Hackney 4 merges them, so `partial_chain` must be
set too: Hackney's own one trusts any certificate in the peer chain that is
in certifi.
"""
@spec ssl_options(keyword()) :: keyword()
def ssl_options(overrides \\ []) do
- Keyword.merge(
- [
- verify: :verify_peer,
- cacertfile: CAStore.file_path(),
- depth: 20,
- customize_hostname_check: [match_fun: :public_key.pkix_verify_hostname_match_fun(:https)],
- partial_chain: &__MODULE__.reject_partial_chain/1
- ],
- overrides
- )
+ defaults = [
+ verify: :verify_peer,
+ cacertfile: CAStore.file_path(),
+ depth: 20,
+ customize_hostname_check: [match_fun: :public_key.pkix_verify_hostname_match_fun(:https)],
+ partial_chain: &__MODULE__.reject_partial_chain/1
+ ]
+
+ # Hackney drops cacerts when cacertfile is set too.
+ defaults =
+ if Keyword.has_key?(overrides, :cacerts),
+ do: Keyword.delete(defaults, :cacertfile),
+ else: defaults
+
+ Keyword.merge(defaults, overrides)
end
@doc false
def reject_partial_chain(_certs), do: :unknown_ca
@spec put_hackney_ssl_options(keyword()) :: keyword()
def put_hackney_ssl_options(opts) do
+ # Hackney 4 ignores the top-level insecure option and falls back to certifi.
if opts[:insecure] do
- opts
+ Keyword.put(opts, :ssl_options, verify: :verify_none)
else
- Keyword.put(opts, :ssl_options, ssl_options(Keyword.get(opts, :ssl_options, [])))
+ opts
+ |> Keyword.put(:ssl_options, ssl_options(Keyword.get(opts, :ssl_options, [])))
+ |> Keyword.put(:proxy_ssl_options, ssl_options(Keyword.get(opts, :proxy_ssl_options, [])))
end
end
end
diff --git a/test/pleroma/http/adapter_helper/tesla_adapter_test.exs b/test/pleroma/http/adapter_helper/tesla_adapter_test.exs
index 1ee2f13ba..96b68d352 100644
--- a/test/pleroma/http/adapter_helper/tesla_adapter_test.exs
+++ b/test/pleroma/http/adapter_helper/tesla_adapter_test.exs
@@ -1,34 +1,35 @@
# Pleroma: A lightweight social networking server
# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
# SPDX-License-Identifier: AGPL-3.0-only
defmodule Pleroma.HTTP.AdapterHelper.TeslaAdapterTest do
use ExUnit.Case, async: false
alias Pleroma.HTTP.AdapterHelper
alias Pleroma.HTTP.TLS
setup do
adapter = Application.get_env(:tesla, :adapter)
on_exit(fn -> Application.put_env(:tesla, :adapter, adapter) end)
end
test "adds the TLS options to Hackney" do
Application.put_env(:tesla, :adapter, Tesla.Adapter.Hackney)
- assert AdapterHelper.tesla_adapter() ==
- {Tesla.Adapter.Hackney, ssl_options: TLS.ssl_options()}
+ assert {Tesla.Adapter.Hackney, opts} = AdapterHelper.tesla_adapter()
+ assert opts[:ssl_options] == TLS.ssl_options()
+ assert opts[:proxy_ssl_options] == TLS.ssl_options()
end
test "turns on certificate checks for Gun" do
Application.put_env(:tesla, :adapter, Tesla.Adapter.Gun)
assert AdapterHelper.tesla_adapter() == {Tesla.Adapter.Gun, certificates_verification: true}
end
test "keeps other adapters" do
Application.put_env(:tesla, :adapter, {Tesla.Adapter.Finch, name: MyFinch})
assert AdapterHelper.tesla_adapter() == {Tesla.Adapter.Finch, name: MyFinch}
end
end
diff --git a/test/pleroma/http/tls_test.exs b/test/pleroma/http/tls_test.exs
index 490950b50..a8701038c 100644
--- a/test/pleroma/http/tls_test.exs
+++ b/test/pleroma/http/tls_test.exs
@@ -1,53 +1,70 @@
# Pleroma: A lightweight social networking server
# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
# SPDX-License-Identifier: AGPL-3.0-only
defmodule Pleroma.HTTP.TLSTest do
use ExUnit.Case, async: true
alias Pleroma.HTTP.TLS
describe "ssl_options/1" do
test "verifies peers against the CAStore bundle" do
opts = TLS.ssl_options()
assert opts[:verify] == :verify_peer
assert opts[:cacertfile] == CAStore.file_path()
assert [match_fun: match_fun] = opts[:customize_hostname_check]
assert is_function(match_fun, 2)
end
test "does not accept certificates from the peer chain as trust anchors" do
partial_chain = TLS.ssl_options()[:partial_chain]
assert partial_chain.([:certificate]) == :unknown_ca
end
+ test "keeps CA certificates that the admin set" do
+ opts = TLS.ssl_options(cacerts: [:private_ca])
+
+ assert opts[:cacerts] == [:private_ca]
+ refute Keyword.has_key?(opts, :cacertfile)
+ end
+
test "keeps the CA bundle when other options are given" do
opts = TLS.ssl_options(versions: [:"tlsv1.2"])
assert opts[:versions] == [:"tlsv1.2"]
assert opts[:cacertfile] == CAStore.file_path()
assert opts[:verify] == :verify_peer
end
end
describe "put_hackney_ssl_options/1" do
test "adds the TLS options" do
opts = TLS.put_hackney_ssl_options(pool: :media)
assert opts[:pool] == :media
assert opts[:ssl_options] == TLS.ssl_options()
+ assert opts[:proxy_ssl_options] == TLS.ssl_options()
end
test "merges given ssl_options into the TLS options" do
opts = TLS.put_hackney_ssl_options(ssl_options: [versions: [:"tlsv1.2"]])
assert opts[:ssl_options] == TLS.ssl_options(versions: [:"tlsv1.2"])
end
- test "leaves insecure requests alone" do
- assert TLS.put_hackney_ssl_options(insecure: true) == [insecure: true]
+ test "turns insecure into an explicit verify_none" do
+ opts = TLS.put_hackney_ssl_options(insecure: true)
+
+ assert opts[:ssl_options] == [verify: :verify_none]
+ refute Keyword.has_key?(opts, :proxy_ssl_options)
+ end
+
+ test "secures the connection to an HTTPS proxy" do
+ opts = TLS.put_hackney_ssl_options(proxy_ssl_options: [versions: [:"tlsv1.3"]])
+
+ assert opts[:proxy_ssl_options] == TLS.ssl_options(versions: [:"tlsv1.3"])
end
end
end

File Metadata

Mime Type
text/x-diff
Expires
Sat, Oct 31, 8:38 PM (18 h, 47 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
1801767
Default Alt Text
(6 KB)

Event Timeline