Mercurial > repos > guerler > springsuite

comparison planemo/lib/python3.7/site-packages/urllib3/util/ssl_.py @ 1:56ad4e20f292 draft

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
"planemo upload commit 6eee67778febed82ddd413c3ca40b3183a3898f1"
author guerler
date Fri, 31 Jul 2020 00:32:28 -0400
parents
children
comparison
equal deleted inserted replaced
0:d30785e31577 1:56ad4e20f292
1 from __future__ import absolute_import
2 import errno
3 import warnings
4 import hmac
5 import os
6 import sys
7
8 from binascii import hexlify, unhexlify
9 from hashlib import md5, sha1, sha256
10
11 from .url import IPV4_RE, BRACELESS_IPV6_ADDRZ_RE
12 from ..exceptions import SSLError, InsecurePlatformWarning, SNIMissingWarning
13 from ..packages import six
14
15
16 SSLContext = None
17 HAS_SNI = False
18 IS_PYOPENSSL = False
19 IS_SECURETRANSPORT = False
20
21 # Maps the length of a digest to a possible hash function producing this digest
22 HASHFUNC_MAP = {32: md5, 40: sha1, 64: sha256}
23
24
25 def _const_compare_digest_backport(a, b):
26 """
27 Compare two digests of equal length in constant time.
28
29 The digests must be of type str/bytes.
30 Returns True if the digests match, and False otherwise.
31 """
32 result = abs(len(a) - len(b))
33 for left, right in zip(bytearray(a), bytearray(b)):
34 result |= left ^ right
35 return result == 0
36
37
38 _const_compare_digest = getattr(hmac, "compare_digest", _const_compare_digest_backport)
39
40 try: # Test for SSL features
41 import ssl
42 from ssl import wrap_socket, CERT_REQUIRED
43 from ssl import HAS_SNI # Has SNI?
44 except ImportError:
45 pass
46
47 try: # Platform-specific: Python 3.6
48 from ssl import PROTOCOL_TLS
49
50 PROTOCOL_SSLv23 = PROTOCOL_TLS
51 except ImportError:
52 try:
53 from ssl import PROTOCOL_SSLv23 as PROTOCOL_TLS
54
55 PROTOCOL_SSLv23 = PROTOCOL_TLS
56 except ImportError:
57 PROTOCOL_SSLv23 = PROTOCOL_TLS = 2
58
59
60 try:
61 from ssl import OP_NO_SSLv2, OP_NO_SSLv3, OP_NO_COMPRESSION
62 except ImportError:
63 OP_NO_SSLv2, OP_NO_SSLv3 = 0x1000000, 0x2000000
64 OP_NO_COMPRESSION = 0x20000
65
66
67 # A secure default.
68 # Sources for more information on TLS ciphers:
69 #
70 # - https://wiki.mozilla.org/Security/Server_Side_TLS
71 # - https://www.ssllabs.com/projects/best-practices/index.html
72 # - https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/
73 #
74 # The general intent is:
75 # - prefer cipher suites that offer perfect forward secrecy (DHE/ECDHE),
76 # - prefer ECDHE over DHE for better performance,
77 # - prefer any AES-GCM and ChaCha20 over any AES-CBC for better performance and
78 # security,
79 # - prefer AES-GCM over ChaCha20 because hardware-accelerated AES is common,
80 # - disable NULL authentication, MD5 MACs, DSS, and other
81 # insecure ciphers for security reasons.
82 # - NOTE: TLS 1.3 cipher suites are managed through a different interface
83 # not exposed by CPython (yet!) and are enabled by default if they're available.
84 DEFAULT_CIPHERS = ":".join(
85 [
86 "ECDHE+AESGCM",
87 "ECDHE+CHACHA20",
88 "DHE+AESGCM",
89 "DHE+CHACHA20",
90 "ECDH+AESGCM",
91 "DH+AESGCM",
92 "ECDH+AES",
93 "DH+AES",
94 "RSA+AESGCM",
95 "RSA+AES",
96 "!aNULL",
97 "!eNULL",
98 "!MD5",
99 "!DSS",
100 ]
101 )
102
103 try:
104 from ssl import SSLContext # Modern SSL?
105 except ImportError:
106
107 class SSLContext(object): # Platform-specific: Python 2
108 def __init__(self, protocol_version):
109 self.protocol = protocol_version
110 # Use default values from a real SSLContext
111 self.check_hostname = False
112 self.verify_mode = ssl.CERT_NONE
113 self.ca_certs = None
114 self.options = 0
115 self.certfile = None
116 self.keyfile = None
117 self.ciphers = None
118
119 def load_cert_chain(self, certfile, keyfile):
120 self.certfile = certfile
121 self.keyfile = keyfile
122
123 def load_verify_locations(self, cafile=None, capath=None, cadata=None):
124 self.ca_certs = cafile
125
126 if capath is not None:
127 raise SSLError("CA directories not supported in older Pythons")
128
129 if cadata is not None:
130 raise SSLError("CA data not supported in older Pythons")
131
132 def set_ciphers(self, cipher_suite):
133 self.ciphers = cipher_suite
134
135 def wrap_socket(self, socket, server_hostname=None, server_side=False):
136 warnings.warn(
137 "A true SSLContext object is not available. This prevents "
138 "urllib3 from configuring SSL appropriately and may cause "
139 "certain SSL connections to fail. You can upgrade to a newer "
140 "version of Python to solve this. For more information, see "
141 "https://urllib3.readthedocs.io/en/latest/advanced-usage.html"
142 "#ssl-warnings",
143 InsecurePlatformWarning,
144 )
145 kwargs = {
146 "keyfile": self.keyfile,
147 "certfile": self.certfile,
148 "ca_certs": self.ca_certs,
149 "cert_reqs": self.verify_mode,
150 "ssl_version": self.protocol,
151 "server_side": server_side,
152 }
153 return wrap_socket(socket, ciphers=self.ciphers, **kwargs)
154
155
156 def assert_fingerprint(cert, fingerprint):
157 """
158 Checks if given fingerprint matches the supplied certificate.
159
160 :param cert:
161 Certificate as bytes object.
162 :param fingerprint:
163 Fingerprint as string of hexdigits, can be interspersed by colons.
164 """
165
166 fingerprint = fingerprint.replace(":", "").lower()
167 digest_length = len(fingerprint)
168 hashfunc = HASHFUNC_MAP.get(digest_length)
169 if not hashfunc:
170 raise SSLError("Fingerprint of invalid length: {0}".format(fingerprint))
171
172 # We need encode() here for py32; works on py2 and p33.
173 fingerprint_bytes = unhexlify(fingerprint.encode())
174
175 cert_digest = hashfunc(cert).digest()
176
177 if not _const_compare_digest(cert_digest, fingerprint_bytes):
178 raise SSLError(
179 'Fingerprints did not match. Expected "{0}", got "{1}".'.format(
180 fingerprint, hexlify(cert_digest)
181 )
182 )
183
184
185 def resolve_cert_reqs(candidate):
186 """
187 Resolves the argument to a numeric constant, which can be passed to
188 the wrap_socket function/method from the ssl module.
189 Defaults to :data:`ssl.CERT_REQUIRED`.
190 If given a string it is assumed to be the name of the constant in the
191 :mod:`ssl` module or its abbreviation.
192 (So you can specify `REQUIRED` instead of `CERT_REQUIRED`.
193 If it's neither `None` nor a string we assume it is already the numeric
194 constant which can directly be passed to wrap_socket.
195 """
196 if candidate is None:
197 return CERT_REQUIRED
198
199 if isinstance(candidate, str):
200 res = getattr(ssl, candidate, None)
201 if res is None:
202 res = getattr(ssl, "CERT_" + candidate)
203 return res
204
205 return candidate
206
207
208 def resolve_ssl_version(candidate):
209 """
210 like resolve_cert_reqs
211 """
212 if candidate is None:
213 return PROTOCOL_TLS
214
215 if isinstance(candidate, str):
216 res = getattr(ssl, candidate, None)
217 if res is None:
218 res = getattr(ssl, "PROTOCOL_" + candidate)
219 return res
220
221 return candidate
222
223
224 def create_urllib3_context(
225 ssl_version=None, cert_reqs=None, options=None, ciphers=None
226 ):
227 """All arguments have the same meaning as ``ssl_wrap_socket``.
228
229 By default, this function does a lot of the same work that
230 ``ssl.create_default_context`` does on Python 3.4+. It:
231
232 - Disables SSLv2, SSLv3, and compression
233 - Sets a restricted set of server ciphers
234
235 If you wish to enable SSLv3, you can do::
236
237 from urllib3.util import ssl_
238 context = ssl_.create_urllib3_context()
239 context.options &= ~ssl_.OP_NO_SSLv3
240
241 You can do the same to enable compression (substituting ``COMPRESSION``
242 for ``SSLv3`` in the last line above).
243
244 :param ssl_version:
245 The desired protocol version to use. This will default to
246 PROTOCOL_SSLv23 which will negotiate the highest protocol that both
247 the server and your installation of OpenSSL support.
248 :param cert_reqs:
249 Whether to require the certificate verification. This defaults to
250 ``ssl.CERT_REQUIRED``.
251 :param options:
252 Specific OpenSSL options. These default to ``ssl.OP_NO_SSLv2``,
253 ``ssl.OP_NO_SSLv3``, ``ssl.OP_NO_COMPRESSION``.
254 :param ciphers:
255 Which cipher suites to allow the server to select.
256 :returns:
257 Constructed SSLContext object with specified options
258 :rtype: SSLContext
259 """
260 context = SSLContext(ssl_version or PROTOCOL_TLS)
261
262 context.set_ciphers(ciphers or DEFAULT_CIPHERS)
263
264 # Setting the default here, as we may have no ssl module on import
265 cert_reqs = ssl.CERT_REQUIRED if cert_reqs is None else cert_reqs
266
267 if options is None:
268 options = 0
269 # SSLv2 is easily broken and is considered harmful and dangerous
270 options |= OP_NO_SSLv2
271 # SSLv3 has several problems and is now dangerous
272 options |= OP_NO_SSLv3
273 # Disable compression to prevent CRIME attacks for OpenSSL 1.0+
274 # (issue #309)
275 options |= OP_NO_COMPRESSION
276
277 context.options |= options
278
279 # Enable post-handshake authentication for TLS 1.3, see GH #1634. PHA is
280 # necessary for conditional client cert authentication with TLS 1.3.
281 # The attribute is None for OpenSSL <= 1.1.0 or does not exist in older
282 # versions of Python. We only enable on Python 3.7.4+ or if certificate
283 # verification is enabled to work around Python issue #37428
284 # See: https://bugs.python.org/issue37428
285 if (cert_reqs == ssl.CERT_REQUIRED or sys.version_info >= (3, 7, 4)) and getattr(
286 context, "post_handshake_auth", None
287 ) is not None:
288 context.post_handshake_auth = True
289
290 context.verify_mode = cert_reqs
291 if (
292 getattr(context, "check_hostname", None) is not None
293 ): # Platform-specific: Python 3.2
294 # We do our own verification, including fingerprints and alternative
295 # hostnames. So disable it here
296 context.check_hostname = False
297
298 # Enable logging of TLS session keys via defacto standard environment variable
299 # 'SSLKEYLOGFILE', if the feature is available (Python 3.8+).
300 if hasattr(context, "keylog_filename"):
301 context.keylog_filename = os.environ.get("SSLKEYLOGFILE")
302
303 return context
304
305
306 def ssl_wrap_socket(
307 sock,
308 keyfile=None,
309 certfile=None,
310 cert_reqs=None,
311 ca_certs=None,
312 server_hostname=None,
313 ssl_version=None,
314 ciphers=None,
315 ssl_context=None,
316 ca_cert_dir=None,
317 key_password=None,
318 ca_cert_data=None,
319 ):
320 """
321 All arguments except for server_hostname, ssl_context, and ca_cert_dir have
322 the same meaning as they do when using :func:`ssl.wrap_socket`.
323
324 :param server_hostname:
325 When SNI is supported, the expected hostname of the certificate
326 :param ssl_context:
327 A pre-made :class:`SSLContext` object. If none is provided, one will
328 be created using :func:`create_urllib3_context`.
329 :param ciphers:
330 A string of ciphers we wish the client to support.
331 :param ca_cert_dir:
332 A directory containing CA certificates in multiple separate files, as
333 supported by OpenSSL's -CApath flag or the capath argument to
334 SSLContext.load_verify_locations().
335 :param key_password:
336 Optional password if the keyfile is encrypted.
337 :param ca_cert_data:
338 Optional string containing CA certificates in PEM format suitable for
339 passing as the cadata parameter to SSLContext.load_verify_locations()
340 """
341 context = ssl_context
342 if context is None:
343 # Note: This branch of code and all the variables in it are no longer
344 # used by urllib3 itself. We should consider deprecating and removing
345 # this code.
346 context = create_urllib3_context(ssl_version, cert_reqs, ciphers=ciphers)
347
348 if ca_certs or ca_cert_dir or ca_cert_data:
349 try:
350 context.load_verify_locations(ca_certs, ca_cert_dir, ca_cert_data)
351 except IOError as e: # Platform-specific: Python 2.7
352 raise SSLError(e)
353 # Py33 raises FileNotFoundError which subclasses OSError
354 # These are not equivalent unless we check the errno attribute
355 except OSError as e: # Platform-specific: Python 3.3 and beyond
356 if e.errno == errno.ENOENT:
357 raise SSLError(e)
358 raise
359
360 elif ssl_context is None and hasattr(context, "load_default_certs"):
361 # try to load OS default certs; works well on Windows (require Python3.4+)
362 context.load_default_certs()
363
364 # Attempt to detect if we get the goofy behavior of the
365 # keyfile being encrypted and OpenSSL asking for the
366 # passphrase via the terminal and instead error out.
367 if keyfile and key_password is None and _is_key_file_encrypted(keyfile):
368 raise SSLError("Client private key is encrypted, password is required")
369
370 if certfile:
371 if key_password is None:
372 context.load_cert_chain(certfile, keyfile)
373 else:
374 context.load_cert_chain(certfile, keyfile, key_password)
375
376 # If we detect server_hostname is an IP address then the SNI
377 # extension should not be used according to RFC3546 Section 3.1
378 # We shouldn't warn the user if SNI isn't available but we would
379 # not be using SNI anyways due to IP address for server_hostname.
380 if (
381 server_hostname is not None and not is_ipaddress(server_hostname)
382 ) or IS_SECURETRANSPORT:
383 if HAS_SNI and server_hostname is not None:
384 return context.wrap_socket(sock, server_hostname=server_hostname)
385
386 warnings.warn(
387 "An HTTPS request has been made, but the SNI (Server Name "
388 "Indication) extension to TLS is not available on this platform. "
389 "This may cause the server to present an incorrect TLS "
390 "certificate, which can cause validation failures. You can upgrade to "
391 "a newer version of Python to solve this. For more information, see "
392 "https://urllib3.readthedocs.io/en/latest/advanced-usage.html"
393 "#ssl-warnings",
394 SNIMissingWarning,
395 )
396
397 return context.wrap_socket(sock)
398
399
400 def is_ipaddress(hostname):
401 """Detects whether the hostname given is an IPv4 or IPv6 address.
402 Also detects IPv6 addresses with Zone IDs.
403
404 :param str hostname: Hostname to examine.
405 :return: True if the hostname is an IP address, False otherwise.
406 """
407 if not six.PY2 and isinstance(hostname, bytes):
408 # IDN A-label bytes are ASCII compatible.
409 hostname = hostname.decode("ascii")
410 return bool(IPV4_RE.match(hostname) or BRACELESS_IPV6_ADDRZ_RE.match(hostname))
411
412
413 def _is_key_file_encrypted(key_file):
414 """Detects if a key file is encrypted or not."""
415 with open(key_file, "r") as f:
416 for line in f:
417 # Look for Proc-Type: 4,ENCRYPTED
418 if "ENCRYPTED" in line:
419 return True
420
421 return False