Disable ssl VERIFY_X509_STRICT with self-signed certificate DNS #737

therve · 2024-12-07T14:16:06Z

The new flag enforced in Python 3.13 with
python/cpython#107361 doesn't work with the semi broken Freebox self signed certificates.

It should fix home-assistant/core#132333

Fixes #734

The new flag enforced in Python 3.13 with python/cpython#107361 doesn't work with the semi broken Freebox self signed certificates. It should fix home-assistant/core#132333 Fixes hacf-fr#734

olivierh65 · 2024-12-13T18:55:18Z

For me, this doesn't solve the problem described in home-assistant/core#132333.

I had to disable certificate verification:

        ssl_ctx = ssl.create_default_context()
        ssl_ctx.load_verify_locations(cafile=cert_path)
      + ssl_ctx.check_hostname = False
      + ssl_ctx.verify_mode = ssl.CERT_NONE

        conn = aiohttp.TCPConnector(ssl_context=ssl_ctx)
        self._session = aiohttp.ClientSession(connector=conn)```

therve · 2024-12-14T09:12:09Z

It's surprising. There is no reason for the SSL verification to work in python 3.12 and to start failing suddenly with 3.13. The main thing that changed with 3.13 is the 2 additional flags. Can you try disabling VERIFY_X509_PARTIAL_CHAIN?

olivierh65 · 2024-12-14T10:27:14Z

I tried to disable only VERIFY_X509_PARTIAL_CHAIN , but it didn't solve the problem.

therve · 2024-12-14T11:20:35Z

OK I'm not sure what's going on. I can confirm that this PR works for me with a Delta.

Quentame · 2024-12-15T12:31:04Z

Currently testing on Revolution

Quentame · 2024-12-15T12:32:20Z

@olivierh65 : what Freebox model, Freebox firmware version and Python version do you have ?

Quentame · 2024-12-15T13:13:24Z

From py3.11: OK ✅
To py3.13 before your PR: ❌

aiohttp.client_exceptions.ClientConnectorCertificateError: Cannot connect to host mafreebox.freebox.fr:443 ssl:True [SSLCertVerificationError: (1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Missing Authority Key Identifier (_ssl.c:1018)')]

To py3.13 after your PR: OK ✅

src/freebox_api/aiofreepybox.py

Quentame

Tested and working, thanks !

Co-authored-by: Quentame <polletquentin74@me.com>

jeanrobertjs · 2024-12-16T15:21:47Z

@olivierh65 : what Freebox model, Freebox firmware version and Python version do you have ?

I have the same issue on Freebox Delta.

These are my configs:

Python version = 3.13

and from : http://mafreebox.freebox.fr/api_version I get :

"box_model_name": "Freebox v7 (r1)",
"https_available": true,
"box_model": "fbxgw7-r1/full",
"api_version": "12.2",
"device_type": "FreeboxServer7,1"

@Quentame How can I test your PR, pls?

olivierh65 · 2024-12-16T15:47:27Z

On my side : {"box_model_name":"Freebox Server (r2)","api_base_url":"\/api\/","https_port":0000pp,"device_name":"Freebox Server","https_available":true,"box_model":"fbxgw-r2\/full","api_domain":"llllllllll.fbxos.fr","api_version":"12.2","device_type":"FreeboxServer1,2"} If you create a new domain with a let's crypt certificat, and use this domain to connect the plug-in, it should work.

Quentame · 2024-12-17T19:22:40Z

@jeanrobertjs

How can I test your PR, pls?

By running this file

@olivierh65

If you create a new domain with a let's crypt certificat, and use this domain to connect the plug-in, it should work.

What I wrote there home-assistant/core#132333 (comment) 😉

olivierh65 · 2024-12-17T19:51:33Z

@jeanrobertjs

@olivierh65

If you create a new domain with a let's crypt certificat, and use this domain to connect the plug-in, it should work.

What I wrote there home-assistant/core#132333 (comment) 😉

Yes, it was just a confirmation

C-Duv · 2025-01-05T14:45:51Z

src/freebox_api/aiofreepybox.py

@@ -118,6 +118,10 @@ async def open(self, host: str, port: str) -> None:
        cert_path = os.path.join(os.path.dirname(__file__), "freebox_certificates.pem")
        ssl_ctx = ssl.create_default_context()
        ssl_ctx.load_verify_locations(cafile=cert_path)
+        if ".fbxos.fr" in host or "mafreebox.freebox.fr" in host:


I think an host.endswith(".fboxos.fr") and host = "mafreebox.freebox.fr" would be safer.

Indeed, but I am finally not sure of keeping this check, as there is an issue with Italian Freeboxes : Illiadbox

See home-assistant/core#133246

Or using some kind of regex that should match both FR and ITA boxes.
As bo?x(os)?([\w\.]+)?\.[\w]{2,4}, to match:

invalid: .fbxos.fr

invalid: mafreebox.freebox.fr

valid: custom.freeboxos.fr

invalid: .ibxos.it

invalid: myiliadbox.iliad.it

valid: custom.iliadboxos.it

But the issue is that this regex matches all DNS, including valid ones.

OK, found one that matches only invalid ones (bxos)|(box\.[\w]+)\.[\w]{2,4}.

But not sure if this is even needed ...

If Free/the Iliad Group expend in an other country, we probably need to update that, and I don't really want to see an other issue for that.

@Quentame If you want to do a regex, I think your last one is not strict enough (demo).

Iliad is not going to expand to other countries regularly so I don't know if it is worth opening the SSL exclusion that much. Also we can't know in advance what name they could take and even if we can guess a pattern (eg: myiliadbox.iliad.pt and .ibxos.pt if they expand to portugal), it would not be very secure to include all tlds.

I suggest instead to stay explicit and add exclusions on a case-by-case basis. It can be condensed into a regex but it must be strict enough (demo):

(mafreebox\.freebox\.fr$)|(\.fbxos\.fr$)|(myiliadbox\.iliad\.it$)|(\.ibxos\.it$)

And if they continue along the lines of iliad.tld/.ibxos.tld then it will be enough to add these tlds in the regex (demo):

(mafreebox\.freebox\.fr$)|(\.fbxos\.fr$)|(myiliadbox\.iliad\.(it|pt|co\.uk)$)|(\.ibxos\.(it|pt|co\.uk)$)

If you really want to be more permissive to avoid future code edit, you could allow all country tlds like this (demo) :

(mafreebox\.freebox\.fr$)|(\.fbxos\.fr$)|(myiliadbox\.iliad\.([a-z]{2,4}|co\.uk)$)|(\.ibxos\.([a-z]{2,4}|co\.uk)$)

Disable ssl VERIFY_X509_STRICT

b8dd930

The new flag enforced in Python 3.13 with python/cpython#107361 doesn't work with the semi broken Freebox self signed certificates. It should fix home-assistant/core#132333 Fixes hacf-fr#734

cyr-ius mentioned this pull request Dec 7, 2024

Tchao Bye bye the token file #738

Open

SamyDjemai mentioned this pull request Dec 10, 2024

Freebox integration is no longer working due to SSLCertVerificationError home-assistant/core#132333

Closed

Wrap comment

7a7012a

Quentame self-assigned this Dec 15, 2024

Quentame reviewed Dec 15, 2024

View reviewed changes

src/freebox_api/aiofreepybox.py Outdated Show resolved Hide resolved

Quentame approved these changes Dec 15, 2024

View reviewed changes

Update src/freebox_api/aiofreepybox.py

eac7120

Co-authored-by: Quentame <polletquentin74@me.com>

Quentame changed the title ~~Disable ssl VERIFY_X509_STRICT~~ Disable ssl VERIFY_X509_STRICT with self-signed certificate DNS Dec 17, 2024

Quentame added the bug Something isn't working label Dec 17, 2024

Quentame merged commit 8b2a0d2 into hacf-fr:master Dec 17, 2024
1 check passed

This was referenced Dec 17, 2024

Release 1.2.0 #747

Merged

Release 1.2.0 #748

Merged

Bump Freebox to 1.2.1 home-assistant/core#133455

Merged

iMicknl mentioned this pull request Dec 17, 2024

Fix local SSL verification in Python 3.13 iMicknl/python-overkiz-api#1478

Merged

C-Duv reviewed Jan 5, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Disable ssl VERIFY_X509_STRICT with self-signed certificate DNS #737

Disable ssl VERIFY_X509_STRICT with self-signed certificate DNS #737

therve commented Dec 7, 2024

olivierh65 commented Dec 13, 2024 •

edited

Loading

therve commented Dec 14, 2024

olivierh65 commented Dec 14, 2024

therve commented Dec 14, 2024

Quentame commented Dec 15, 2024

Quentame commented Dec 15, 2024

Quentame commented Dec 15, 2024

Quentame left a comment

jeanrobertjs commented Dec 16, 2024

olivierh65 commented Dec 16, 2024 via email

Quentame commented Dec 17, 2024

olivierh65 commented Dec 17, 2024

C-Duv Jan 5, 2025

Quentame Jan 9, 2025

Quentame Jan 9, 2025

Quentame Jan 9, 2025 •

edited

Loading

theblackhole Jan 10, 2025

Disable ssl VERIFY_X509_STRICT with self-signed certificate DNS #737

Disable ssl VERIFY_X509_STRICT with self-signed certificate DNS #737

Conversation

therve commented Dec 7, 2024

olivierh65 commented Dec 13, 2024 • edited Loading

therve commented Dec 14, 2024

olivierh65 commented Dec 14, 2024

therve commented Dec 14, 2024

Quentame commented Dec 15, 2024

Quentame commented Dec 15, 2024

Quentame commented Dec 15, 2024

Quentame left a comment

Choose a reason for hiding this comment

jeanrobertjs commented Dec 16, 2024

olivierh65 commented Dec 16, 2024 via email

Quentame commented Dec 17, 2024

olivierh65 commented Dec 17, 2024

C-Duv Jan 5, 2025

Choose a reason for hiding this comment

Quentame Jan 9, 2025

Choose a reason for hiding this comment

Quentame Jan 9, 2025

Choose a reason for hiding this comment

Quentame Jan 9, 2025 • edited Loading

Choose a reason for hiding this comment

theblackhole Jan 10, 2025

Choose a reason for hiding this comment

olivierh65 commented Dec 13, 2024 •

edited

Loading

Quentame Jan 9, 2025 •

edited

Loading