--no-check-certificate options

Allows the disabling of server TLS certificate checks.

diff --git a/suricata/update/main.py b/suricata/update/main.py
index a46935d1a091a6b99ab91599c1fc2da65f6d6e50..5f5b08aab2b7bf5f3870da95066687fe24b62de0 100644 (file)
--- a/suricata/update/main.py
+++ b/suricata/update/main.py
@@ -34,7 +34,7 @@ import io
 
 try:
     # Python 3.
-    from urllib.error import HTTPError
+    from urllib.error import URLError
 except ImportError:
     # Python 2.7.
     from urllib2 import URLError
@@ -944,6 +944,9 @@ def _main():
     global_parser.add_argument(
         "--user-agent", metavar="<user-agent>",
         help="Set custom user-agent string")
+    global_parser.add_argument(
+        "--no-check-certificate", action="store_true", default=None,
+        help="Disable server SSL/TLS certificate verification")
 
     global_args, rem = global_parser.parse_known_args()
 

diff --git a/suricata/update/net.py b/suricata/update/net.py
index 6fb68c6d912483e674538880a7a832c59d6dc084..33679de50cf9801ea1987e0c3fbdc0afd7ab4444 100644 (file)
--- a/suricata/update/net.py
+++ b/suricata/update/net.py
@@ -19,17 +19,21 @@
 
 import platform
 import logging
+import ssl
 
 try:
     # Python 3.3...
     from urllib.request import urlopen, build_opener
     from urllib.error import HTTPError
+    from urllib.request import HTTPSHandler
 except ImportError:
     # Python 2.6, 2.7.
     from urllib2 import urlopen, build_opener
     from urllib2 import HTTPError
+    from urllib2 import HTTPSHandler
 
 from suricata.update.version import version
+from suricata.update import config
 
 logger = logging.getLogger()
 
@@ -87,7 +91,15 @@ def get(url, fileobj, progress_hook=None):
     user_agent = build_user_agent()
     logger.debug("Setting HTTP user-agent to %s", user_agent)
 
-    opener = build_opener()
+    ssl_context = ssl.create_default_context()
+
+    if config.get("no-check-certificate"):
+        logger.debug("Disabling SSL/TLS certificate verification.")
+        ssl_context.check_hostname = False
+        ssl_context.verify_mode = ssl.CERT_NONE
+
+    opener = build_opener(HTTPSHandler(context=ssl_context))
+
     opener.addheaders = [
         ("User-Agent", build_user_agent()),
     ]