search

GoogleCloudPlatform / cloud-sql-python-connector

A Python library for connecting securely to your Cloud SQL instances.
Apache License 2.0
271 stars 65 forks source link

Check that server certificate contains instance name during TLS handshake #1087

Open hessjcg opened 1 month ago

hessjcg commented 1 month ago

Feature Description

The server certificate's subject CN field in the server certificate will contain the instance name in the form "{project}:{instance}". The python connector should validate that this is correctly set during the TLS handshake. The connector should reject the connection if this the server CN is not set correctly.

See also: https://github.com/GoogleCloudPlatform/cloud-sql-jdbc-socket-factory/issues/1995

jackwotherspoon commented 1 month ago

This is going to be slightly complex to validate during the TLS handshake.

For pg8000, pymysql and pytds it is probably possible to adjust the ssl.wrap_socket() to set do_handshake_on_connect to False, do our verification and then call do_handshake(). Python ssl.wrap_socket documentation

But for asyncpg we don't have control over the handshake at all as it is done in the asyncpg code, we just pass it the SSL/TLS context object.

https://github.com/GoogleCloudPlatform/cloud-sql-python-connector/blob/de2852f1e5333449f3f9b273cf803b85e15ba33f/google/cloud/sql/connector/asyncpg.py#L55-L64