EPN: Enable certificate validation and hostname checking

https://pagure.io/freeipa/issue/8579
Signed-off-by: Stanislav Levin <slev@altlinux.org>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>

ipaclient/install/ipa_epn.py

@@ -29,6 +29,7 @@ import os
 import pwd
 import logging
 import smtplib
+import ssl
 import time
 
 from collections import deque
@@ -205,6 +206,7 @@ class EPN(admintool.AdminTool):
     def __init__(self, options, args):
         super(EPN, self).__init__(options, args)
         self._conn = None
+        self._ssl_context = None
         self._expiring_password_user_list = EPNUserList()
         self._ldap_data = []
         self._date_ranges = []
@@ -291,12 +293,15 @@ class EPN(admintool.AdminTool):
             logger.error("IPA client is not configured on this system.")
             raise admintool.ScriptError()
 
+        # tasks required privileges
         self._get_krb5_ticket()
         self._read_configuration()
         self._validate_configuration()
         self._parse_configuration()
         self._get_connection()
         self._read_ipa_configuration()
+        self._create_ssl_context()
+
         drop_privileges()
         if self.options.mailtest:
             self._gentestdata()
@@ -316,6 +321,7 @@ class EPN(admintool.AdminTool):
                 smtp_timeout=api.env.smtp_timeout,
                 smtp_username=api.env.smtp_user,
                 smtp_password=api.env.smtp_password,
+                ssl_context=self._ssl_context,
                 x_mailer=self.command_name,
                 msg_subtype=api.env.msg_subtype,
                 msg_charset=api.env.msg_charset,
@@ -457,6 +463,14 @@ class EPN(admintool.AdminTool):
 
         return self._conn
 
+    def _create_ssl_context(self):
+        """Create SSL context.
+           This must be done before the dropping priviliges to allow
+           read in the smtp client's certificate and private key if specified.
+        """
+        if api.env.smtp_security.lower() in ("starttls", "ssl"):
+            self._ssl_context = ssl.create_default_context()
+
     def _fetch_data_from_ldap(self, date_range):
         """Run a LDAP query to fetch a list of user entries whose passwords
            would expire in the near future. Store in self._ldap_data.
@@ -603,15 +617,15 @@ class MTAClient:
         smtp_timeout=60,
         smtp_username=None,
         smtp_password=None,
+        ssl_context=None,
     ):
-        # We only support "none" (cleartext) for now.
-        # Future values: "ssl", "starttls"
         self._security_protocol = security_protocol
         self._smtp_hostname = smtp_hostname
         self._smtp_port = smtp_port
         self._smtp_timeout = smtp_timeout
         self._username = smtp_username
         self._password = smtp_password
+        self._ssl_context = ssl_context
 
         # This should not be touched
         self._conn = None
@@ -664,6 +678,7 @@ class MTAClient:
                     host=self._smtp_hostname,
                     port=self._smtp_port,
                     timeout=self._smtp_timeout,
+                    context=self._ssl_context,
                 )
         except (socketerror, smtplib.SMTPException) as e:
             msg = \
@@ -687,7 +702,7 @@ class MTAClient:
 
         if self._security_protocol.lower() == "starttls":
             try:
-                self._conn.starttls()
+                self._conn.starttls(context=self._ssl_context)
                 self._conn.ehlo()
             except smtplib.SMTPException as e:
                 raise RuntimeError(
@@ -743,6 +758,7 @@ class MailUserAgent:
         smtp_timeout=60,
         smtp_username=None,
         smtp_password=None,
+        ssl_context=None,
         x_mailer=None,
         msg_subtype="plain",
         msg_charset="utf8",
@@ -766,6 +782,7 @@ class MailUserAgent:
             smtp_timeout=smtp_timeout,
             smtp_username=smtp_username,
             smtp_password=smtp_password,
+            ssl_context=ssl_context,
         )
 
     def cleanup(self):