Prepare release 4.7.1 (#2947)

Author: sfc-gh-pczajka

DESCRIPTION.md

@@ -7,11 +7,10 @@ https://docs.snowflake.com/
 Source code is also available at: https://github.com/snowflakedb/snowflake-connector-python
 
 # Release Notes
-- NEXT_RELEASE(TBD)
+- v4.7.1(Jul 15,2026)
   - Added support for Python 3.14t (free-threaded).
     - **Note:** Python 3.14t CI testing excludes `win_arm64` (no `cryptography` wheels available) and `mitmproxy` proxy tests on all platforms (transitive dependencies `aioquic`/`pylsqpack` lack free-threaded-compatible wheels).
-
-- v4.7.0(Jul 2,2026)
+  - Improved verification of TLS connections (SNOW-3675579).
   - Fixed `python-connector.log` not rotating on Windows, and every record being logged twice, when easy logging is enabled via `config.toml` (SNOW-3680325).
     - **Note:** As part of this fix, easy logging no longer calls `logging.basicConfig()` and therefore no longer configures the root logger. `python-connector.log` now captures only the `snowflake.connector`, `botocore`, and `boto3`.
   - Improved URL validation reliability by replacing the hand-rolled regex in `is_valid_url()` with `urllib.parse.urlparse` (SNOW-3392651).

src/snowflake/connector/ssl_wrap_socket.py

@@ -29,6 +29,7 @@
 from .vendored.urllib3 import connection as connection_
 from .vendored.urllib3.contrib.pyopenssl import PyOpenSSLContext, WrappedSocket
 from .vendored.urllib3.util import ssl_ as ssl_
+from .vendored.urllib3.util.ssl_match_hostname import CertificateError, match_hostname
 
 if TYPE_CHECKING:
     from cryptography import x509
@@ -85,13 +86,79 @@ def _ensure_partial_chain_on_context(ctx: PyOpenSSLContext, cafile: str | None)
         pass
 
 
-def _build_context_with_partial_chain(cafile: str | None) -> PyOpenSSLContext:
-    """Create PyOpenSSL context configured for CERT_REQUIRED and partial-chain trust."""
+def _nonnegative_options(value: int) -> int:
+    """Return *value* as the non-negative bitmask pyOpenSSL/cryptography expects.
+
+    ``ssl.SSLContext.options`` is exposed through a signed, platform-width C
+    ``long``. On Windows that type is 32 bits, so the common default mask (which
+    has bit 31 set, e.g. ``0x82520050``) is returned as a *negative* Python int.
+    cryptography's binding marshals the value into an unsigned parameter and
+    rejects negatives with ``OverflowError: can't convert negative number to
+    unsigned`` -- which previously aborted every Windows TLS handshake the
+    moment we carried these options onto the substituted ``PyOpenSSLContext``.
+    Recover the intended unsigned 32-bit mask; values that are already
+    non-negative (every other platform) pass through unchanged.
+    """
+    return value & 0xFFFFFFFF if value < 0 else value
+
+
+def _apply_stdlib_hardening(dst: PyOpenSSLContext, src: ssl.SSLContext | None) -> None:
+    """Carry TLS hardening from a stdlib ``SSLContext`` onto ``dst``.
+
+    The connector replaces the stdlib ``ssl.SSLContext`` that urllib3 builds
+    (or that a caller supplied) with a ``PyOpenSSLContext``. Without copying the
+    original context's hardening forward, the substitution silently drops the
+    TLS-version floor and ``OP_NO_*`` options urllib3 configured and
+    any hardening a caller set on a supplied context. Copy the
+    settings we can read back; fall back to urllib3's default floor when there
+    is no source context to mirror.
+
+    Limitation: cipher restrictions and pinned CA material (``cadata`` /
+    ``load_verify_locations``) cannot be read back out of an ``ssl.SSLContext``,
+    so they cannot be transferred here. Honoring caller-supplied pinning needs a
+    dedicated, supported channel and is tracked as a follow-up.
+    """
+    if isinstance(src, ssl.SSLContext):
+        # Mirror the protocol-version floor/ceiling and OpenSSL options the
+        # original context carried (e.g. TLS 1.2 minimum, OP_NO_SSLv3,
+        # OP_NO_COMPRESSION) plus any caller hardening (e.g. VERIFY_X509_STRICT).
+        for attr in ("minimum_version", "maximum_version", "verify_flags"):
+            try:
+                setattr(dst, attr, getattr(src, attr))
+            except (ValueError, OSError, OpenSSL.SSL.Error):
+                # Best-effort; an unsupported value must not break the handshake.
+                pass
+        try:
+            dst.options |= _nonnegative_options(src.options)
+        except (ValueError, OSError, OpenSSL.SSL.Error, OverflowError, TypeError):
+            # Best-effort; carrying options forward must never break the
+            # handshake even if a value can't be marshalled into pyOpenSSL.
+            pass
+    else:
+        # No source context to mirror (no ssl_context was supplied): restore the
+        # hardening urllib3's create_urllib3_context() would have applied.
+        try:
+            dst.minimum_version = ssl.TLSVersion.TLSv1_2
+            dst.options |= ssl.OP_NO_COMPRESSION
+        except (ValueError, OSError, OpenSSL.SSL.Error, OverflowError, TypeError):
+            pass
+
+
+def _build_context_with_partial_chain(
+    cafile: str | None, src_context: ssl.SSLContext | None = None
+) -> PyOpenSSLContext:
+    """Create PyOpenSSL context configured for CERT_REQUIRED and partial-chain trust.
+
+    When ``src_context`` is the stdlib context being replaced, its TLS hardening
+    (version floor, options, verify flags) is carried forward so the
+    substitution does not weaken the connection.
+    """
     ctx = PyOpenSSLContext(ssl_.PROTOCOL_TLS_CLIENT)
     try:
         ctx.verify_mode = ssl.CERT_REQUIRED
     except Exception:
         pass
+    _apply_stdlib_hardening(ctx, src_context)
     _ensure_partial_chain_on_context(ctx, cafile)
     return ctx
 
@@ -168,6 +235,54 @@ def _load_trusted_certificates(cafile: str | None) -> list[x509.Certificate]:
     return [load_der_x509_certificate(cert, default_backend()) for cert in certs]
 
 
+def _verify_hostname_after_handshake(
+    wrapped_socket: WrappedSocket,
+    server_hostname: str | None,
+    ssl_context: Any,
+) -> None:
+    """Match the peer certificate against *server_hostname*."""
+    # Honor explicitly-disabled certificate verification (CERT_NONE) first; when
+    # verification is off there is nothing to assert about server identity, so a
+    # missing hostname is acceptable. Check this before the hostname so we only
+    # skip when the caller genuinely opted out of verification.
+    verify_mode = getattr(ssl_context, "verify_mode", ssl.CERT_REQUIRED)
+    if verify_mode == ssl.CERT_NONE:
+        return
+
+    # Verification is required but there is no host to match against (e.g. TLS
+    # without SNI). Fail closed rather than accepting the peer: without a
+    # hostname we cannot assert server identity.
+    if not server_hostname:
+        raise CertificateError(
+            "no server hostname supplied to match against the peer certificate; "
+            "cannot verify server identity"
+        )
+
+    # Normalize bracketed / scoped IPv6 literals the same way urllib3 does:
+    # strip the brackets and drop any "%scope" suffix before testing for an IP,
+    # since Python's ssl module treats scoped addresses as DNS hostnames.
+    normalized = server_hostname.strip("[]")
+    if "%" in normalized:
+        normalized = normalized[: normalized.rfind("%")]
+    if ssl_.is_ipaddress(normalized):
+        server_hostname = normalized
+
+    cert = wrapped_socket.getpeercert()
+    try:
+        match_hostname(cert, server_hostname)
+    except CertificateError as e:
+        log.warning(
+            "Certificate did not match expected hostname: %s. Certificate: %s",
+            server_hostname,
+            cert,
+        )
+        # Attach the cert so callers catching CertificateError can inspect it,
+        # matching urllib3's own _match_hostname behavior.
+        e._peer_cert = cert
+        wrapped_socket.close()
+        raise
+
+
 @wraps(ssl_.ssl_wrap_socket)
 def ssl_wrap_socket_with_cert_revocation_checks(
     *args: Any, **kwargs: Any
@@ -186,13 +301,19 @@ def ssl_wrap_socket_with_cert_revocation_checks(
     provided_ctx = params.get("ssl_context")
     cafile_for_ctx = _resolve_cafile(params)
     if not isinstance(provided_ctx, PyOpenSSLContext):
-        params["ssl_context"] = _build_context_with_partial_chain(cafile_for_ctx)
+        # Carry the replaced stdlib context's TLS hardening forward so the
+        # substitution doesn't silently weaken the connection.
+        params["ssl_context"] = _build_context_with_partial_chain(
+            cafile_for_ctx, src_context=provided_ctx
+        )
     else:
         # If a PyOpenSSLContext is provided, ensure it trusts the provided CA and partial-chain is enabled
         _ensure_partial_chain_on_context(provided_ctx, cafile_for_ctx)
 
     ret = ssl_.ssl_wrap_socket(**params)
 
+    _verify_hostname_after_handshake(ret, server_hostname, params.get("ssl_context"))
+
     log.debug(
         "CRL Check Mode: %s",
         FEATURE_CRL_CONFIG.cert_revocation_check_mode.name,

src/snowflake/connector/version.py

@@ -1,3 +1,3 @@
 # Update this for the versions
 # Don't change the fourth version number from None
-VERSION = (4, 7, 0, None)
+VERSION = (4, 7, 1, None)