Security warning for API-SSL connect without SSL certificate (anonymous Diffie-Hellman)

Author: akpw

README.md

@@ -73,7 +73,8 @@ The default configuration file comes with a sample configuration, making it easy
     
     use_ssl = False                 # enables connection via API-SSL servis
     no_ssl_certificate = False      # enables API_SSL connect without router SSL certificate
-    ssl_certificate_verify = False  # turns SSL certificate verification on / off   
+    ssl_certificate_verify = False  # turns SSL certificate verification on / off
+    ssl_check_hostname = True       # check if the hostname matches the peer cert’s hostname
     ssl_ca_file = ""                # path to the certificate authority file to validate against, leave empty to use system store
     plaintext_login = True          # for legacy RouterOS versions below 6.43 use False
 

deploy/kubernetes/secret.yaml

@@ -71,7 +71,8 @@ stringData:
             
             use_ssl = False                 # enables connection via API-SSL servis
             no_ssl_certificate = False      # enables API_SSL connect without router SSL certificate
-            ssl_certificate_verify = False  # turns SSL certificate verification on / off   
+            ssl_certificate_verify = False  # turns SSL certificate verification on / off
+            ssl_check_hostname = True       # check if the hostname matches the peer cert’s hostname 
             ssl_ca_file = ""                # path to the certificate authority file to validate against, leave empty to use system store
             plaintext_login = True          # for legacy RouterOS versions below 6.43 use False
 

mktxp/flow/router_connection.py

@@ -111,6 +111,8 @@ def connect(self):
             return
         try:
             print(f'Connecting to router {self.router_name}@{self.config_entry.hostname}')
+            if self.config_entry.use_ssl and self.config_entry.no_ssl_certificate:
+                print(f'Warning: API_SSL connect without router SSL certificate is insecure and should not be used in production environments!')
             self.connection.plaintext_login = self.config_entry.plaintext_login
             self.api = self.connection.get_api()
             self._set_connect_state(success = True, connect_time = connect_time)