Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

TLSAdapter bugfixes #96

Merged
merged 3 commits into from
Apr 20, 2024
Merged

TLSAdapter bugfixes #96

Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
0345497
honor the SSLKEYLOGFILE environment variable
mildsunrise Apr 16, 2024
a78357e
fix --no-verify
mildsunrise Apr 16, 2024
c859bc8
fixup: also set verify_mode to CERT_NONE
mildsunrise Apr 19, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 12 additions & 2 deletions gp_saml_gui.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@
import tempfile

from operator import setitem
from os import path, dup2, execvp
from os import path, dup2, execvp, environ
from shlex import quote
from sys import stderr, platform
from binascii import a2b_base64, b2a_base64
Expand Down Expand Up @@ -212,10 +212,20 @@ class TLSAdapter(requests.adapters.HTTPAdapter):
We have extracted the relevant value from <openssl/ssl.h>.

'''

def __init__(self, verify=True):
self.verify = verify
super().__init__()

def init_poolmanager(self, connections, maxsize, block=False):
ssl_context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
ssl_context.set_ciphers('DEFAULT:@SECLEVEL=1')
ssl_context.options |= 1<<2 # OP_LEGACY_SERVER_CONNECT
ssl_context.check_hostname = self.verify
mildsunrise marked this conversation as resolved.
Show resolved Hide resolved
if hasattr(ssl_context, "keylog_filename"):
sslkeylogfile = environ.get("SSLKEYLOGFILE")
if sslkeylogfile:
ssl_context.keylog_filename = sslkeylogfile
mildsunrise marked this conversation as resolved.
Show resolved Hide resolved
self.poolmanager = urllib3.PoolManager(
num_pools=connections,
maxsize=maxsize,
Expand Down Expand Up @@ -284,7 +294,7 @@ def main(args = None):

s = requests.Session()
if args.insecure:
s.mount('https://', TLSAdapter())
s.mount('https://', TLSAdapter(verify=args.verify))
s.headers['User-Agent'] = 'PAN GlobalProtect' if args.user_agent is None else args.user_agent
s.cert = args.cert

Expand Down
Loading