certmaster/SSLCommon.py

   1 # This program is free software; you can redistribute it and/or modify
   2 # it under the terms of the GNU General Public License as published by
   3 # the Free Software Foundation; either version 2 of the License, or
   4 # (at your option) any later version.
   5 #
   6 # This program is distributed in the hope that it will be useful,
   7 # but WITHOUT ANY WARRANTY; without even the implied warranty of
   8 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   9 # GNU Library General Public License for more details.
  10 #
  11 # You should have received a copy of the GNU General Public License
  12 # along with this program; if not, write to the Free Software
  13 # Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
  14 #
  15 # Copyright 2005 Dan Williams <dcbw@redhat.com> and Red Hat, Inc.
  16
  17 import os, sys
  18 from OpenSSL import SSL
  19 import SSLConnection
  20 import httplib
  21 import socket
  22 import SocketServer
  23
  24 def our_verify(connection, x509, errNum, errDepth, preverifyOK):
  25     # print "Verify: errNum = %s, errDepth = %s, preverifyOK = %s" % (errNum, errDepth, preverifyOK)
  26
  27     # preverifyOK should tell us whether or not the client's certificate
  28     # correctly authenticates against the CA chain
  29     return preverifyOK
  30
  31
  32 def CreateSSLContext(pkey, cert, ca_cert, passwd_callback=None):
  33     for f in pkey, cert, ca_cert:
  34         if f and not os.access(f, os.R_OK):
  35             print "%s does not exist or is not readable." % f
  36             os._exit(1)
  37
  38     ctx = SSL.Context(SSL.SSLv3_METHOD)   # SSLv3 only
  39     if passwd_callback:
  40         ctx.set_passwd_cb = passwd_callback
  41
  42     ctx.use_certificate_file(cert)
  43     ctx.use_privatekey_file(pkey)
  44     ctx.load_client_ca(ca_cert)
  45     ctx.load_verify_locations(ca_cert)
  46     verify = SSL.VERIFY_PEER | SSL.VERIFY_FAIL_IF_NO_PEER_CERT
  47     ctx.set_verify(verify, our_verify)
  48     ctx.set_verify_depth(10)
  49     ctx.set_options(SSL.OP_NO_SSLv2 | SSL.OP_NO_TLSv1)
  50     return ctx
  51
  52
  53
  54 class BaseServer(SocketServer.TCPServer):
  55     allow_reuse_address = 1
  56
  57     def __init__(self, server_addr, req_handler):
  58         self._quit = False
  59         self.allow_reuse_address = 1
  60         SocketServer.TCPServer.__init__(self, server_addr, req_handler)
  61
  62     def stop(self):
  63         self._quit = True
  64
  65     def serve_forever(self):
  66         while not self._quit:
  67             self.handle_request()
  68         self.server_close()
  69
  70
  71 class BaseSSLServer(BaseServer):
  72     """ SSL-enabled variant """
  73
  74     def __init__(self, server_address, req_handler, pkey, cert, ca_cert, timeout=None):
  75         self._timeout = timeout
  76         self.ssl_ctx = CreateSSLContext(pkey, cert, ca_cert)
  77
  78         BaseServer.__init__(self, server_address, req_handler)
  79
  80         sock = socket.socket(self.address_family, self.socket_type)
  81         con = SSL.Connection(self.ssl_ctx, sock)
  82         self.socket = SSLConnection.SSLConnection(con)
  83         if sys.version_info[:3] >= (2, 3, 0):
  84             self.socket.settimeout(self._timeout)
  85         self.server_bind()
  86         self.server_activate()
  87
  88         host, port = self.socket.getsockname()[:2]
  89         self.server_name = socket.getfqdn(host)
  90         self.server_port = port
  91
  92
  93 class HTTPSConnection(httplib.HTTPConnection):
  94     "This class allows communication via SSL."
  95
  96     response_class = httplib.HTTPResponse
  97
  98     def __init__(self, host, port=None, ssl_context=None, strict=None, timeout=None):
  99         httplib.HTTPConnection.__init__(self, host, port, strict)
 100         self.ssl_ctx = ssl_context
 101         self._timeout = timeout
 102
 103     def connect(self):
 104         sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 105         con = SSL.Connection(self.ssl_ctx, sock)
 106         self.sock = SSLConnection.SSLConnection(con)
 107         if sys.version_info[:3] >= (2, 3, 0):
 108             self.sock.settimeout(self._timeout)
 109         self.sock.connect((self.host, self.port))
 110
 111
 112 class HTTPS(httplib.HTTP):
 113     """Compatibility with 1.5 httplib interface
 114
 115     Python 1.5.2 did not have an HTTPS class, but it defined an
 116     interface for sending http requests that is also useful for
 117     https.
 118     """
 119
 120     _connection_class = HTTPSConnection
 121
 122     def __init__(self, host='', port=None, ssl_context=None, strict=None, timeout=None):
 123         self._setup(self._connection_class(host, port, ssl_context, strict, timeout))
 124