tobias/docker-offlineimap
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Extend handling of cert_fingerprint

Browse Source 
Add ability to specify multiple fingerprints.

Signed-off-by: Eygene Ryabinkin <rea@codelabs.ru>
This commit is contained in:
Eygene Ryabinkin 2014-05-07 01:22:29 +04:00
parent 1690e5f74e
commit d2ec2a4e9e
4 changed files with 32 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Changelog.rst
View File

@ -20,6 +20,8 @@ OfflineIMAP v6.5.6 (YYYY-MM-DD)
(if $XDG_CONFIG_HOME/offlineimap/config exists, use it as the (if $XDG_CONFIG_HOME/offlineimap/config exists, use it as the
default configuration path; ~/.offlineimaprc is still tried after default configuration path; ~/.offlineimaprc is still tried after
XDG location) (GitHub#32) XDG location) (GitHub#32)
* Allow multiple certificate fingerprints to be specified inside
'cert_fingerprint'
OfflineIMAP v6.5.5 (2013-10-07) OfflineIMAP v6.5.5 (2013-10-07)

7
offlineimap.conf
View File

@ -395,8 +395,13 @@ ssl = yes
# has not changed on each connect and refuse to connect otherwise. # has not changed on each connect and refuse to connect otherwise.
# You can also configure this in addition to CA certificate validation # You can also configure this in addition to CA certificate validation
# above and it will check both ways. # above and it will check both ways.
#
# Multiple fingerprints can be specified, separated by commas.
#
# Fingerprints must be in hexadecimal form without leading '0x':
# 40 hex digits like bbfe29cf97acb204591edbafe0aa8c8f914287c9.
#cert_fingerprint = <SHA1_of_server_certificate_here> #cert_fingerprint = <SHA1_of_server_certificate_here>[, <another_SHA1>]
# SSL version (optional) # SSL version (optional)
# It is best to leave this unset, in which case the correct version will be # It is best to leave this unset, in which case the correct version will be

21
offlineimap/imaplibutil.py
View File

@ -141,21 +141,28 @@ class WrappedIMAP4_SSL(UsefulIMAPMixIn, IMAP4_SSL):
"""Improved version of imaplib.IMAP4_SSL overriding select()""" """Improved version of imaplib.IMAP4_SSL overriding select()"""
def __init__(self, *args, **kwargs): def __init__(self, *args, **kwargs):
self._fingerprint = kwargs.get('fingerprint', None) self._fingerprint = kwargs.get('fingerprint', None)
if type(self._fingerprint) != type([]):
self._fingerprint = [self._fingerprint]
if 'fingerprint' in kwargs: if 'fingerprint' in kwargs:
del kwargs['fingerprint'] del kwargs['fingerprint']
super(WrappedIMAP4_SSL, self).__init__(*args, **kwargs) super(WrappedIMAP4_SSL, self).__init__(*args, **kwargs)
def open(self, host=None, port=None): def open(self, host=None, port=None):
if not self.ca_certs and not self._fingerprint:
raise OfflineImapError("No CA certificates " + \
"and no server fingerprints configured. " + \
"You must configure at least something, otherwise " + \
"having SSL helps nothing.", OfflineImapError.ERROR.REPO)
super(WrappedIMAP4_SSL, self).open(host, port) super(WrappedIMAP4_SSL, self).open(host, port)
if (self._fingerprint or not self.ca_certs): if self._fingerprint:
# compare fingerprints # compare fingerprints
fingerprint = sha1(self.sock.getpeercert(True)).hexdigest() fingerprint = sha1(self.sock.getpeercert(True)).hexdigest()
if fingerprint != self._fingerprint: if fingerprint not in self._fingerprint:
raise OfflineImapError("Server SSL fingerprint '%s' for hostnam" raise OfflineImapError("Server SSL fingerprint '%s' " % fingerprint + \
"e '%s' does not match configured fingerprint. Please ver" "for hostname '%s' " % host + \
"ify and set 'cert_fingerprint' accordingly if not set ye" "does not match configured fingerprint(s) %s. " % self._fingerprint + \
"t." % (fingerprint, host), "Please verify and set 'cert_fingerprint' accordingly " + \
OfflineImapError.ERROR.REPO) "if not set yet.", OfflineImapError.ERROR.REPO)
class WrappedIMAP4(UsefulIMAPMixIn, IMAP4): class WrappedIMAP4(UsefulIMAPMixIn, IMAP4):

11
offlineimap/repository/IMAP.py
View File

@ -215,7 +215,16 @@ class IMAPRepository(BaseRepository):
return self.getconf('ssl_version', None) return self.getconf('ssl_version', None)
def get_ssl_fingerprint(self): def get_ssl_fingerprint(self):
return self.getconf('cert_fingerprint', None) """
Return array of possible certificate fingerprints.
Configuration item cert_fingerprint can contain multiple
comma-separated fingerprints in hex form.
"""
value = self.getconf('cert_fingerprint', "")
return [f.strip().lower() for f in value.split(',') if f]
def getpreauthtunnel(self): def getpreauthtunnel(self):
return self.getconf('preauthtunnel', None) return self.getconf('preauthtunnel', None)