mirror of
https://github.com/python/cpython.git
synced 2025-07-29 14:15:07 +00:00
This contains a number of things:
1) Improve the documentation of the SSL module, with a fuller explanation of certificate usage, another reference, proper formatting of this and that. 2) Fix Windows bug in ssl.py, and general bug in sslsocket.close(). Remove some unused code from ssl.py. Allow accept() to be called on sslsocket sockets. 3) Use try-except-else in import of ssl in socket.py. Deprecate use of socket.ssl(). 4) Remove use of socket.ssl() in every library module, except for test_socket_ssl.py and test_ssl.py.
This commit is contained in:
Bill Janssen
parent
492e5920bc
commit
426ea0a864
9 changed files with 486 additions and 608 deletions
199
Lib/ssl.py
199
Lib/ssl.py
|
|
@ -58,55 +58,47 @@ PROTOCOL_TLSv1
|
|||
import os, sys
|
||||
|
||||
import _ssl # if we can't import it, let the error propagate
|
||||
from socket import socket
|
||||
from _ssl import sslerror
|
||||
from _ssl import CERT_NONE, CERT_OPTIONAL, CERT_REQUIRED
|
||||
from _ssl import PROTOCOL_SSLv2, PROTOCOL_SSLv3, PROTOCOL_SSLv23, PROTOCOL_TLSv1
|
||||
from _ssl import \
|
||||
SSL_ERROR_ZERO_RETURN, \
|
||||
SSL_ERROR_WANT_READ, \
|
||||
SSL_ERROR_WANT_WRITE, \
|
||||
SSL_ERROR_WANT_X509_LOOKUP, \
|
||||
SSL_ERROR_SYSCALL, \
|
||||
SSL_ERROR_SSL, \
|
||||
SSL_ERROR_WANT_CONNECT, \
|
||||
SSL_ERROR_EOF, \
|
||||
SSL_ERROR_INVALID_ERROR_CODE
|
||||
|
||||
from socket import socket
|
||||
from socket import getnameinfo as _getnameinfo
|
||||
|
||||
# Root certs:
|
||||
#
|
||||
# The "ca_certs" argument to sslsocket() expects a file containing one or more
|
||||
# certificates that are roots of various certificate signing chains. This file
|
||||
# contains the certificates in PEM format (RFC ) where each certificate is
|
||||
# encoded in base64 encoding and surrounded with a header and footer:
|
||||
# -----BEGIN CERTIFICATE-----
|
||||
# ... (CA certificate in base64 encoding) ...
|
||||
# -----END CERTIFICATE-----
|
||||
# The various certificates in the file are just concatenated together:
|
||||
# -----BEGIN CERTIFICATE-----
|
||||
# ... (CA certificate in base64 encoding) ...
|
||||
# -----END CERTIFICATE-----
|
||||
# -----BEGIN CERTIFICATE-----
|
||||
# ... (a second CA certificate in base64 encoding) ...
|
||||
# -----END CERTIFICATE-----
|
||||
#
|
||||
# Some "standard" root certificates are available at
|
||||
#
|
||||
# http://www.thawte.com/roots/ (for Thawte roots)
|
||||
# http://www.verisign.com/support/roots.html (for Verisign)
|
||||
|
||||
class sslsocket (socket):
|
||||
|
||||
"""This class implements a subtype of socket.socket that wraps
|
||||
the underlying OS socket in an SSL context when necessary, and
|
||||
provides read and write methods over that channel."""
|
||||
|
||||
def __init__(self, sock, keyfile=None, certfile=None,
|
||||
server_side=False, cert_reqs=CERT_NONE,
|
||||
ssl_version=PROTOCOL_SSLv23, ca_certs=None):
|
||||
socket.__init__(self, _sock=sock._sock)
|
||||
if certfile and not keyfile:
|
||||
keyfile = certfile
|
||||
if server_side:
|
||||
self._sslobj = _ssl.sslwrap(self._sock, 1, keyfile, certfile,
|
||||
cert_reqs, ssl_version, ca_certs)
|
||||
# see if it's connected
|
||||
try:
|
||||
socket.getpeername(self)
|
||||
except:
|
||||
# no, no connection yet
|
||||
self._sslobj = None
|
||||
else:
|
||||
# see if it's connected
|
||||
try:
|
||||
socket.getpeername(self)
|
||||
except:
|
||||
# no, no connection yet
|
||||
self._sslobj = None
|
||||
else:
|
||||
# yes, create the SSL object
|
||||
self._sslobj = _ssl.sslwrap(self._sock, 0, keyfile, certfile,
|
||||
cert_reqs, ssl_version, ca_certs)
|
||||
# yes, create the SSL object
|
||||
self._sslobj = _ssl.sslwrap(self._sock, server_side,
|
||||
keyfile, certfile,
|
||||
cert_reqs, ssl_version, ca_certs)
|
||||
self.keyfile = keyfile
|
||||
self.certfile = certfile
|
||||
self.cert_reqs = cert_reqs
|
||||
|
|
@ -123,59 +115,77 @@ class sslsocket (socket):
|
|||
return self._sslobj.peer_certificate()
|
||||
|
||||
def send (self, data, flags=0):
|
||||
if flags != 0:
|
||||
raise ValueError(
|
||||
"non-zero flags not allowed in calls to send() on %s" %
|
||||
self.__class__)
|
||||
return self._sslobj.write(data)
|
||||
if self._sslobj:
|
||||
if flags != 0:
|
||||
raise ValueError(
|
||||
"non-zero flags not allowed in calls to send() on %s" %
|
||||
self.__class__)
|
||||
return self._sslobj.write(data)
|
||||
else:
|
||||
return socket.send(self, data, flags)
|
||||
|
||||
def send_to (self, data, addr, flags=0):
|
||||
raise ValueError("send_to not allowed on instances of %s" %
|
||||
self.__class__)
|
||||
if self._sslobj:
|
||||
raise ValueError("send_to not allowed on instances of %s" %
|
||||
self.__class__)
|
||||
else:
|
||||
return socket.send_to(self, data, addr, flags)
|
||||
|
||||
def sendall (self, data, flags=0):
|
||||
if flags != 0:
|
||||
raise ValueError(
|
||||
"non-zero flags not allowed in calls to sendall() on %s" %
|
||||
self.__class__)
|
||||
return self._sslobj.write(data)
|
||||
if self._sslobj:
|
||||
if flags != 0:
|
||||
raise ValueError(
|
||||
"non-zero flags not allowed in calls to sendall() on %s" %
|
||||
self.__class__)
|
||||
return self._sslobj.write(data)
|
||||
else:
|
||||
return socket.sendall(self, data, flags)
|
||||
|
||||
def recv (self, buflen=1024, flags=0):
|
||||
if flags != 0:
|
||||
raise ValueError(
|
||||
"non-zero flags not allowed in calls to sendall() on %s" %
|
||||
self.__class__)
|
||||
return self._sslobj.read(data, buflen)
|
||||
if self._sslobj:
|
||||
if flags != 0:
|
||||
raise ValueError(
|
||||
"non-zero flags not allowed in calls to sendall() on %s" %
|
||||
self.__class__)
|
||||
return self._sslobj.read(data, buflen)
|
||||
else:
|
||||
return socket.recv(self, buflen, flags)
|
||||
|
||||
def recv_from (self, addr, buflen=1024, flags=0):
|
||||
raise ValueError("recv_from not allowed on instances of %s" %
|
||||
self.__class__)
|
||||
if self._sslobj:
|
||||
raise ValueError("recv_from not allowed on instances of %s" %
|
||||
self.__class__)
|
||||
else:
|
||||
return socket.recv_from(self, addr, buflen, flags)
|
||||
|
||||
def shutdown(self):
|
||||
def ssl_shutdown(self):
|
||||
if self._sslobj:
|
||||
self._sslobj.shutdown()
|
||||
self._sslobj = None
|
||||
else:
|
||||
socket.shutdown(self)
|
||||
|
||||
def shutdown(self, how):
|
||||
self.ssl_shutdown()
|
||||
socket.shutdown(self, how)
|
||||
|
||||
def close(self):
|
||||
if self._sslobj:
|
||||
self.shutdown()
|
||||
else:
|
||||
socket.close(self)
|
||||
self.ssl_shutdown()
|
||||
socket.close(self)
|
||||
|
||||
def connect(self, addr):
|
||||
# Here we assume that the socket is client-side, and not
|
||||
# connected at the time of the call. We connect it, then wrap it.
|
||||
if self._sslobj or (self.getsockname()[1] != 0):
|
||||
if self._sslobj:
|
||||
raise ValueError("attempt to connect already-connected sslsocket!")
|
||||
socket.connect(self, addr)
|
||||
self._sslobj = _ssl.sslwrap(self._sock, 0, self.keyfile, self.certfile,
|
||||
self._sslobj = _ssl.sslwrap(self._sock, False, self.keyfile, self.certfile,
|
||||
self.cert_reqs, self.ssl_version,
|
||||
self.ca_certs)
|
||||
|
||||
def accept(self):
|
||||
raise ValueError("accept() not supported on an sslsocket")
|
||||
newsock, addr = socket.accept(self)
|
||||
return (sslsocket(newsock, True, self.keyfile, self.certfile,
|
||||
self.cert_reqs, self.ssl_version,
|
||||
self.ca_certs), addr)
|
||||
|
||||
|
||||
# some utility functions
|
||||
|
|
@ -190,64 +200,3 @@ def sslwrap_simple (sock, keyfile=None, certfile=None):
|
|||
|
||||
return _ssl.sslwrap(sock._sock, 0, keyfile, certfile, CERT_NONE,
|
||||
PROTOCOL_SSLv23, None)
|
||||
|
||||
# fetch the certificate that the server is providing in PEM form
|
||||
|
||||
def fetch_server_certificate (host, port):
|
||||
|
||||
import re, tempfile, os
|
||||
|
||||
def subproc(cmd):
|
||||
from subprocess import Popen, PIPE, STDOUT
|
||||
proc = Popen(cmd, stdout=PIPE, stderr=STDOUT, shell=True)
|
||||
status = proc.wait()
|
||||
output = proc.stdout.read()
|
||||
return status, output
|
||||
|
||||
def strip_to_x509_cert(certfile_contents, outfile=None):
|
||||
m = re.search(r"^([-]+BEGIN CERTIFICATE[-]+[\r]*\n"
|
||||
r".*[\r]*^[-]+END CERTIFICATE[-]+)$",
|
||||
certfile_contents, re.MULTILINE | re.DOTALL)
|
||||
if not m:
|
||||
return None
|
||||
else:
|
||||
tn = tempfile.mktemp()
|
||||
fp = open(tn, "w")
|
||||
fp.write(m.group(1) + "\n")
|
||||
fp.close()
|
||||
try:
|
||||
tn2 = (outfile or tempfile.mktemp())
|
||||
status, output = subproc(r'openssl x509 -in "%s" -out "%s"' %
|
||||
(tn, tn2))
|
||||
if status != 0:
|
||||
raise OperationError(status, tsig, output)
|
||||
fp = open(tn2, 'rb')
|
||||
data = fp.read()
|
||||
fp.close()
|
||||
os.unlink(tn2)
|
||||
return data
|
||||
finally:
|
||||
os.unlink(tn)
|
||||
|
||||
if sys.platform.startswith("win"):
|
||||
tfile = tempfile.mktemp()
|
||||
fp = open(tfile, "w")
|
||||
fp.write("quit\n")
|
||||
fp.close()
|
||||
try:
|
||||
status, output = subproc(
|
||||
'openssl s_client -connect "%s:%s" -showcerts < "%s"' %
|
||||
(host, port, tfile))
|
||||
finally:
|
||||
os.unlink(tfile)
|
||||
else:
|
||||
status, output = subproc(
|
||||
'openssl s_client -connect "%s:%s" -showcerts < /dev/null' %
|
||||
(host, port))
|
||||
if status != 0:
|
||||
raise OSError(status)
|
||||
certtext = strip_to_x509_cert(output)
|
||||
if not certtext:
|
||||
raise ValueError("Invalid response received from server at %s:%s" %
|
||||
(host, port))
|
||||
return certtext
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue