Hi,
It seems that smtplib doesn't check if a certificate is valid (signed by a trusted CA).
For my personal usage, I patched the starttls code in git-multimail: only for starttls with smtplib.
This patch is inspired from
https://github.com/graingert/secure-smtplib/blob/master/src/secure_smtplib/__init__.py
It could be easy to add support cert check in for smtps (see secure_smtplib).
This patch was tested only on git-multimail (v1.2)
It introduces two new options:
- multimailhook.smtpcheckcert (default false)
- multimailhook.smtpcacerts (default
/etc/ssl/certs/ca-certificates.crt)Best regards, Simon P.
diff --git a/git-multimail/git_multimail.py b/git-multimail/git_multimail.py index fae5c91..b49ed9d 100755 --- a/git-multimail/git_multimail.py +++ b/git-multimail/git_multimail.py @@ -57,6 +57,7 @@ import subprocess import shlex import optparse import smtplib +import ssl import time import cgi @@ -1945,6 +1946,7 @@ class SMTPMailer(Mailer): smtpservertimeout=10.0, smtpserverdebuglevel=0, smtpencryption='none', smtpuser='', smtppass='', + smtpcacerts='/etc/ssl/certs/ca-certificates.crt',smtpcheckcert=False ): if not envelopesender: sys.stderr.write( @@ -1974,13 +1976,43 @@ class SMTPMailer(Mailer): if self.security == 'none': self.smtp = call(smtplib.SMTP, self.smtpserver, timeout=self.smtpservertimeout) elif self.security == 'ssl': + if smtpcheckcert: + msg = "Checking certificate is not supported for ssl, prefer starttls" + raise smtplib.SMTPException(msg) self.smtp = call(smtplib.SMTP_SSL, self.smtpserver, timeout=self.smtpservertimeout) elif self.security == 'tls': if ':' not in self.smtpserver: self.smtpserver += ':587' # default port for TLS self.smtp = call(smtplib.SMTP, self.smtpserver, timeout=self.smtpservertimeout) - self.smtp.ehlo() - self.smtp.starttls() + if smtpcheckcert: + # inspired form: + # https://github.com/graingert/secure-smtplib/blob/master/src/secure_smtplib/__init__.py + # but add the path to trusted ca, and force ceritficate verification. + self.smtp.ehlo_or_helo_if_needed() + if not self.smtp.has_extn("starttls"): + msg = "STARTTLS extension not supported by server" + raise smtplib.SMTPException(msg) + (resp, reply) = self.smtp.docmd("STARTTLS") + if resp == 220: + self.smtp.sock = ssl.wrap_socket( + self.smtp.sock, + ca_certs=smtpcacerts, + cert_reqs=ssl.CERT_REQUIRED + ) + if not hasattr(self.smtp.sock, "read"): + # using httplib.FakeSocket with Python 2.5.x or earlier + self.smtp.sock.read = self.smtp.sock.recv + self.smtp.file = smtplib.SSLFakeFile(self.smtp.sock) + self.smtp.helo_resp = None + self.smtp.ehlo_resp = None + self.smtp.esmtp_features = {} + self.smtp.does_esmtp = 0 + else: + msg = "Wrong answer to the STARTTLS command" + raise smtplib.SMTPException(msg) + else: + self.smtp.ehlo() + self.smtp.starttls() self.smtp.ehlo() else: sys.stdout.write('*** Error: Control reached an invalid option. ***') @@ -3500,6 +3532,8 @@ def choose_mailer(config, environment): smtpencryption = config.get('smtpencryption', default='none') smtpuser = config.get('smtpuser', default='') smtppass = config.get('smtppass', default='') + smtpcacerts = config.get('smtpcacerts', default='/etc/ssl/certs/ca-certificates.crt') + smtpcheckcert = config.get_bool('smtpcheckcert', default='false') mailer = SMTPMailer( envelopesender=(environment.get_sender() or environment.get_fromaddr()), smtpserver=smtpserver, smtpservertimeout=smtpservertimeout, @@ -3507,6 +3541,8 @@ def choose_mailer(config, environment): smtpencryption=smtpencryption, smtpuser=smtpuser, smtppass=smtppass, + smtpcacerts=smtpcacerts, + smtpcheckcert=smtpcheckcert ) elif mailer == 'sendmail': command = config.get('sendmailcommand')
