|
| 1 | +# Copyright 2007,2011 Google Inc. |
| 2 | +# |
| 3 | +# Licensed under the Apache License, Version 2.0 (the "License"); |
| 4 | +# you may not use this file except in compliance with the License. |
| 5 | +# You may obtain a copy of the License at |
| 6 | +# |
| 7 | +# http://www.apache.org/licenses/LICENSE-2.0 |
| 8 | +# |
| 9 | +# Unless required by applicable law or agreed to in writing, software |
| 10 | +# distributed under the License is distributed on an "AS IS" BASIS, |
| 11 | +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 12 | +# See the License for the specific language governing permissions and |
| 13 | +# limitations under the License. |
| 14 | +# |
| 15 | + |
| 16 | +# This file is derived from |
| 17 | +# http://googleappengine.googlecode.com/svn-history/r136/trunk/python/google/appengine/tools/https_wrapper.py |
| 18 | + |
| 19 | + |
| 20 | +"""Extensions to allow HTTPS requests with SSL certificate validation.""" |
| 21 | + |
| 22 | +import httplib |
| 23 | +import re |
| 24 | +import socket |
| 25 | +import ssl |
| 26 | +import urllib2 |
| 27 | + |
| 28 | +class InvalidCertificateException(httplib.HTTPException): |
| 29 | + """Raised when a certificate is provided with an invalid hostname.""" |
| 30 | + |
| 31 | + def __init__(self, host, cert, reason): |
| 32 | + """Constructor. |
| 33 | +
|
| 34 | + Args: |
| 35 | + host: The hostname the connection was made to. |
| 36 | + cert: The SSL certificate (as a dictionary) the host returned. |
| 37 | + """ |
| 38 | + httplib.HTTPException.__init__(self) |
| 39 | + self.host = host |
| 40 | + self.cert = cert |
| 41 | + self.reason = reason |
| 42 | + |
| 43 | + def __str__(self): |
| 44 | + return ('Host %s returned an invalid certificate (%s): %s' % |
| 45 | + (self.host, self.reason, self.cert)) |
| 46 | + |
| 47 | +def GetValidHostsForCert(cert): |
| 48 | + """Returns a list of valid host globs for an SSL certificate. |
| 49 | +
|
| 50 | + Args: |
| 51 | + cert: A dictionary representing an SSL certificate. |
| 52 | + Returns: |
| 53 | + list: A list of valid host globs. |
| 54 | + """ |
| 55 | + if 'subjectAltName' in cert: |
| 56 | + return [x[1] for x in cert['subjectAltName'] if x[0].lower() == 'dns'] |
| 57 | + else: |
| 58 | + return [x[0][1] for x in cert['subject'] |
| 59 | + if x[0][0].lower() == 'commonname'] |
| 60 | + |
| 61 | +def ValidateCertificateHostname(cert, hostname): |
| 62 | + """Validates that a given hostname is valid for an SSL certificate. |
| 63 | +
|
| 64 | + Args: |
| 65 | + cert: A dictionary representing an SSL certificate. |
| 66 | + hostname: The hostname to test. |
| 67 | + Returns: |
| 68 | + bool: Whether or not the hostname is valid for this certificate. |
| 69 | + """ |
| 70 | + hosts = GetValidHostsForCert(cert) |
| 71 | + for host in hosts: |
| 72 | + host_re = host.replace('.', '\.').replace('*', '[^.]*') |
| 73 | + if re.search('^%s$' % (host_re,), hostname, re.I): |
| 74 | + return True |
| 75 | + return False |
| 76 | + |
| 77 | + |
| 78 | +class CertValidatingHTTPSConnection(httplib.HTTPConnection): |
| 79 | + """An HTTPConnection that connects over SSL and validates certificates.""" |
| 80 | + |
| 81 | + default_port = httplib.HTTPS_PORT |
| 82 | + |
| 83 | + def __init__(self, host, port=None, key_file=None, cert_file=None, |
| 84 | + ca_certs=None, strict=None, **kwargs): |
| 85 | + """Constructor. |
| 86 | +
|
| 87 | + Args: |
| 88 | + host: The hostname. Can be in 'host:port' form. |
| 89 | + port: The port. Defaults to 443. |
| 90 | + key_file: A file containing the client's private key |
| 91 | + cert_file: A file containing the client's certificates |
| 92 | + ca_certs: A file contianing a set of concatenated certificate authority |
| 93 | + certs for validating the server against. |
| 94 | + strict: When true, causes BadStatusLine to be raised if the status line |
| 95 | + can't be parsed as a valid HTTP/1.0 or 1.1 status line. |
| 96 | + """ |
| 97 | + httplib.HTTPConnection.__init__(self, host, port, strict, **kwargs) |
| 98 | + self.key_file = key_file |
| 99 | + self.cert_file = cert_file |
| 100 | + self.ca_certs = ca_certs |
| 101 | + |
| 102 | + def connect(self): |
| 103 | + "Connect to a host on a given (SSL) port." |
| 104 | + sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) |
| 105 | + sock.connect((self.host, self.port)) |
| 106 | + self.sock = ssl.wrap_socket(sock, keyfile=self.key_file, |
| 107 | + certfile=self.cert_file, |
| 108 | + cert_reqs=ssl.CERT_REQUIRED, |
| 109 | + ca_certs=self.ca_certs) |
| 110 | + cert = self.sock.getpeercert() |
| 111 | + hostname = self.host.split(':', 0)[0] |
| 112 | + if not ValidateCertificateHostname(cert, hostname): |
| 113 | + raise InvalidCertificateException(hostname, |
| 114 | + cert, |
| 115 | + 'remote hostname "%s" does not match '\ |
| 116 | + 'certificate' % hostname) |
| 117 | + |
| 118 | + |
| 119 | +class CertValidatingHTTPSHandler(urllib2.HTTPSHandler): |
| 120 | + """An HTTPHandler that validates SSL certificates.""" |
| 121 | + |
| 122 | + def __init__(self, **kwargs): |
| 123 | + """Constructor. Any keyword args are passed to the httplib handler.""" |
| 124 | + urllib2.HTTPSHandler.__init__(self) |
| 125 | + self._connection_args = kwargs |
| 126 | + |
| 127 | + def https_open(self, req): |
| 128 | + def http_class_wrapper(host, **kwargs): |
| 129 | + full_kwargs = dict(self._connection_args) |
| 130 | + full_kwargs.update(kwargs) |
| 131 | + return CertValidatingHTTPSConnection(host, **full_kwargs) |
| 132 | + try: |
| 133 | + return self.do_open(http_class_wrapper, req) |
| 134 | + except urllib2.URLError, e: |
| 135 | + if type(e.reason) == ssl.SSLError and e.reason.args[0] == 1: |
| 136 | + raise InvalidCertificateException(req.host, '', |
| 137 | + e.reason.args[1]) |
| 138 | + raise |
| 139 | + |
| 140 | + https_request = urllib2.HTTPSHandler.do_request_ |
| 141 | + |
0 commit comments