From 4a9f282bf7a153eecc5b205268df69cbeb4111b3 Mon Sep 17 00:00:00 2001 From: Simeon Simeonov Date: Thu, 16 Apr 2015 21:53:16 +0200 Subject: Implement connection_setup for beinc_weechat.py --- beinc_generic_client.py | 18 ++++---------- beinc_poller.py | 18 ++++---------- beinc_weechat.py | 63 ++++++++++++++++++++++++++++++++++--------------- 3 files changed, 54 insertions(+), 45 deletions(-) diff --git a/beinc_generic_client.py b/beinc_generic_client.py index 48d6a13..ae4762d 100755 --- a/beinc_generic_client.py +++ b/beinc_generic_client.py @@ -109,12 +109,11 @@ def action_execute(args): if sys.hexversion >= 0x20709f0: # Python >= 2.7.9 context = ssl.SSLContext(ssl_version) - context.verify_mode = ssl.CERT_REQUIRED - if args.no_cert_validate: - context.verify_mode = ssl.CERT_NONE - context.check_hostname = bool(not args.disable_hostname_check) - if args.cert and not args.no_cert_validate: + context.verify_mode = ssl.CERT_NONE + if args.cert: + context.verify_mode = ssl.CERT_REQUIRED context.load_verify_locations(os.path.expanduser(args.cert)) + context.check_hostname = bool(not args.disable_hostname_check) if args.ciphers: context.set_ciphers(args.ciphers) transport = xmlrpclib.SafeTransport(context=context) @@ -122,9 +121,8 @@ def action_execute(args): # Python < 2.7.9 ssl_options = {} ssl_options['ssl_version'] = ssl_version - if args.cert and not args.no_cert_validate: + if args.cert: ssl_options['ca_certs'] = os.path.expanduser(args.cert) - if not args.no_cert_validate: ssl_options['cert_reqs'] = ssl.CERT_REQUIRED if args.ciphers: ssl_options['ciphers'] = args.ciphers @@ -199,12 +197,6 @@ def main(): dest='rname', required=True, help='The name of the BEINC-resource on the remote server') - parser.add_argument( - '--no-cert-validate', - action='store_true', - dest='no_cert_validate', - default=False, - help='Do not validate server certificate') parser.add_argument( '-p', '--password', metavar='PASSWORD[FILE]', diff --git a/beinc_poller.py b/beinc_poller.py index f9c5cca..d4eb1e5 100755 --- a/beinc_poller.py +++ b/beinc_poller.py @@ -180,12 +180,11 @@ def poll_notifications(scheduler, args): if sys.hexversion >= 0x20709f0: # Python >= 2.7.9 context = ssl.SSLContext(ssl_version) - context.verify_mode = ssl.CERT_REQUIRED - if args.no_cert_validate: - context.verify_mode = ssl.CERT_NONE - context.check_hostname = bool(not args.disable_hostname_check) - if args.cert and not args.no_cert_validate: + context.verify_mode = ssl.CERT_NONE + if args.cert: + context.verify_mode = ssl.CERT_REQUIRED context.load_verify_locations(os.path.expanduser(args.cert)) + context.check_hostname = bool(not args.disable_hostname_check) if args.ciphers: context.set_ciphers(args.ciphers) transport = xmlrpclib.SafeTransport(context=context) @@ -193,9 +192,8 @@ def poll_notifications(scheduler, args): # Python < 2.7.9 ssl_options = {} ssl_options['ssl_version'] = ssl_version - if args.cert and not args.no_cert_validate: + if args.cert: ssl_options['ca_certs'] = os.path.expanduser(args.cert) - if not args.no_cert_validate: ssl_options['cert_reqs'] = ssl.CERT_REQUIRED if args.ciphers: ssl_options['ciphers'] = args.ciphers @@ -300,12 +298,6 @@ def main(): dest='rname', required=True, help='The name of the BEINC-resource on the remote server') - parser.add_argument( - '--no-cert-validate', - action='store_true', - dest='no_cert_validate', - default=False, - help='Do not validate server certificate') parser.add_argument( '-o', '--osd-system', metavar='SYSTEM', diff --git a/beinc_weechat.py b/beinc_weechat.py index 5f7da5a..442b01f 100644 --- a/beinc_weechat.py +++ b/beinc_weechat.py @@ -1,4 +1,3 @@ -#!/usr/bin/env python # -*- coding: utf-8 -*- # Blackmore's Enhanced IRC-Notification Collection (BEINC) v2.0 @@ -54,34 +53,61 @@ except: pass -class ValidHTTPSConnection(httplib.HTTPConnection): - """ - Implements a simple CERT verification functionality +class BEINCCustomHTTPSConnection(httplib.HTTPConnection): """ + This class allows communication via SSL. + It is a reimplementation of httplib.HTTPSConnection and + allows the server certificate to be validated against CA + This functionality lacks in Python < 2.7.9 + """ default_port = httplib.HTTPS_PORT - def __init__(self, *args, **kwargs): - httplib.HTTPConnection.__init__(self, *args, **kwargs) + def __init__(self, host, port=None, key_file=None, cert_file=None, + strict=None, timeout=socket._GLOBAL_DEFAULT_TIMEOUT, + source_address=None, custom_ssl_options={}): + httplib.HTTPConnection.__init__(self, host, port, strict, timeout, + source_address) + self.key_file = key_file + self.cert_file = cert_file + self.custom_ssl_options = custom_ssl_options def connect(self): + "Connect to a host on a given (SSL) port." sock = socket.create_connection((self.host, self.port), self.timeout, self.source_address) if self._tunnel_host: self.sock = sock self._tunnel() self.sock = ssl.wrap_socket(sock, - ca_certs=global_beinc_cert_file, - cert_reqs=ssl.CERT_REQUIRED) + self.key_file, + self.cert_file, + **self.custom_ssl_options) -class ValidHTTPSHandler(urllib2.HTTPSHandler): - """ - Implements a simple CERT verification functionality - """ +class BEINCCustomSafeTransport(xmlrpclib.Transport): - def https_open(self, req): - return self.do_open(ValidHTTPSConnection, req) + def __init__(self, use_datetime=0, custom_ssl_options={}): + xmlrpclib.Transport.__init__(self, use_datetime=use_datetime) + self.custom_ssl_options = custom_ssl_options + + def make_connection(self, host): + if self._connection and host == self._connection[0]: + return self._connection[1] + try: + HTTPS = BEINCCustomHTTPSConnection + except AttributeError: + raise NotImplementedError( + "your version of httplib doesn't support HTTPS" + ) + else: + chost, self._extra_headers, x509 = self.get_host_info(host) + self._connection = host, HTTPS( + chost, + None, + custom_ssl_options=self.custom_ssl_options, + **(x509 or {})) + return self._connection[1] class WeechatTarget(object): @@ -321,14 +347,13 @@ class WeechatTarget(object): if sys.hexversion >= 0x20709f0: # Python >= 2.7.9 context = ssl.SSLContext(ssl_version) - context.verify_mode = ssl.CERT_REQUIRED - if not self.__cert_file: - context.verify_mode = ssl.CERT_NONE - context.check_hostname = bool( - not self.__disable_hostname_check) + context.verify_mode = ssl.CERT_NONE if self.__cert_file: + context.verify_mode = ssl.CERT_REQUIRED context.load_verify_locations(os.path.expanduser( self.__cert_file)) + context.check_hostname = bool( + not self.__disable_hostname_check) if self.__ciphers: context.set_ciphers(self.__ciphers) transport = xmlrpclib.SafeTransport(context=context) -- cgit v1.3