histrio / py-couchdb

Modern pure python CouchDB Client.
https://pycouchdb.readthedocs.org/
Other
120 stars 43 forks source link

Certificate verification when connecting over HTTPS #68

Closed Xophmeister closed 8 years ago

Xophmeister commented 8 years ago

When I try to connect to CouchDB over an HTTPS connection, urllib3 complains that it is making an insecure request:

InsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.org/en/latest/security.html

Unfortunately, the advice given on the above link can't be applied because pycouchdb doesn't expose any interface with Requests or urllib3.

I tried to get around this by patching the urllib3 connection pool classes (per this answer on StackOverflow):

def patch_connection_pools(**constructor_kwargs):
    """
    Override the default parameters of the HTTPConnectionPool and
    HTTPSConnectionPool constructors
    """
    from requests.packages.urllib3 import connectionpool, poolmanager

    def subtype_connection_pool(base):
        class _ConnectionPool(base):
            def __init__(self, *args, **kwargs):
                kwargs.update(constructor_kwargs)
                super().__init__(*args, **kwargs)

        return _ConnectionPool

    poolmanager.pool_classes_by_scheme['http'] = subtype_connection_pool(connectionpool.HTTPConnectionPool)
    poolmanager.pool_classes_by_scheme['https'] = subtype_connection_pool(connectionpool.HTTPSConnectionPool)

patch_connection_pools(maxsize=16, cert_reqs='CERT_REQUIRED', ca_certs='/path/to/my/cacert.pem')

The patching is definitely being called by pycouchdb (verified by putting a print in the patched constructor), but the cert_reqs and ca_certs arguments have no effect on the warning given by urllib3. (I only assume maxsize is being respected.)

I haven't delved through the source of these libraries too deeply, so I might be targeting the wrong place. Is there any other way I can get pycouchdb to do certificate verification?

Xophmeister commented 8 years ago

Ignore this! I didn't see the verify argument for pycouchdb.client.Server