Coverage for /pythoncovmergedfiles/medio/medio/usr/local/lib/python3.8/site-packages/urllib3/contrib/pyopenssl.py: 31%

1"""

2TLS with SNI_-support for Python 2. Follow these instructions if you would

3like to verify TLS certificates in Python 2. Note, the default libraries do

4*not* do certificate checking; you need to do additional work to validate

5certificates yourself.

7This needs the following packages installed:

9* `pyOpenSSL`_ (tested with 16.0.0)

10* `cryptography`_ (minimum 1.3.4, from pyopenssl)

11* `idna`_ (minimum 2.0, from cryptography)

13However, pyopenssl depends on cryptography, which depends on idna, so while we

14use all three directly here we end up having relatively few packages required.

16You can install them with the following command:

18.. code-block:: bash

20 $ python -m pip install pyopenssl cryptography idna

22To activate certificate checking, call

23:func:`~urllib3.contrib.pyopenssl.inject_into_urllib3` from your Python code

24before you begin making HTTP requests. This can be done in a ``sitecustomize``

25module, or at any other time before your application begins using ``urllib3``,

26like this:

28.. code-block:: python

30 try:

31 import urllib3.contrib.pyopenssl

32 urllib3.contrib.pyopenssl.inject_into_urllib3()

33 except ImportError:

34 pass

36Now you can use :mod:`urllib3` as you normally would, and it will support SNI

37when the required modules are installed.

39Activating this module also has the positive side effect of disabling SSL/TLS

40compression in Python 2 (see `CRIME attack`_).

42.. _sni: https://en.wikipedia.org/wiki/Server_Name_Indication

43.. _crime attack: https://en.wikipedia.org/wiki/CRIME_(security_exploit)

44.. _pyopenssl: https://www.pyopenssl.org

45.. _cryptography: https://cryptography.io

46.. _idna: https://github.com/kjd/idna

47"""

48from __future__ import absolute_import

50import OpenSSL.crypto

51import OpenSSL.SSL

52from cryptography import x509

53from cryptography.hazmat.backends.openssl import backend as openssl_backend

55try:

56 from cryptography.x509 import UnsupportedExtension

57except ImportError:

58 # UnsupportedExtension is gone in cryptography >= 2.1.0

59 class UnsupportedExtension(Exception):

60 pass

63from io import BytesIO

64from socket import error as SocketError

65from socket import timeout

67try: # Platform-specific: Python 2

68 from socket import _fileobject

69except ImportError: # Platform-specific: Python 3

70 _fileobject = None

71 from ..packages.backports.makefile import backport_makefile

73import logging

74import ssl

75import sys

76import warnings

78from .. import util

79from ..packages import six

80from ..util.ssl_ import PROTOCOL_TLS_CLIENT

82warnings.warn(

83 "'urllib3.contrib.pyopenssl' module is deprecated and will be removed "

84 "in a future release of urllib3 2.x. Read more in this issue: "

85 "https://github.com/urllib3/urllib3/issues/2680",

86 category=DeprecationWarning,

87 stacklevel=2,

88)

90__all__ = ["inject_into_urllib3", "extract_from_urllib3"]

92# SNI always works.

93HAS_SNI = True

95# Map from urllib3 to PyOpenSSL compatible parameter-values.

96_openssl_versions = {

97 util.PROTOCOL_TLS: OpenSSL.SSL.SSLv23_METHOD,

98 PROTOCOL_TLS_CLIENT: OpenSSL.SSL.SSLv23_METHOD,

99 ssl.PROTOCOL_TLSv1: OpenSSL.SSL.TLSv1_METHOD,

100}

101

102if hasattr(ssl, "PROTOCOL_SSLv3") and hasattr(OpenSSL.SSL, "SSLv3_METHOD"):

103 _openssl_versions[ssl.PROTOCOL_SSLv3] = OpenSSL.SSL.SSLv3_METHOD

104

105if hasattr(ssl, "PROTOCOL_TLSv1_1") and hasattr(OpenSSL.SSL, "TLSv1_1_METHOD"):

106 _openssl_versions[ssl.PROTOCOL_TLSv1_1] = OpenSSL.SSL.TLSv1_1_METHOD

107

108if hasattr(ssl, "PROTOCOL_TLSv1_2") and hasattr(OpenSSL.SSL, "TLSv1_2_METHOD"):

109 _openssl_versions[ssl.PROTOCOL_TLSv1_2] = OpenSSL.SSL.TLSv1_2_METHOD

110

111

112_stdlib_to_openssl_verify = {

113 ssl.CERT_NONE: OpenSSL.SSL.VERIFY_NONE,

114 ssl.CERT_OPTIONAL: OpenSSL.SSL.VERIFY_PEER,

115 ssl.CERT_REQUIRED: OpenSSL.SSL.VERIFY_PEER

116 + OpenSSL.SSL.VERIFY_FAIL_IF_NO_PEER_CERT,

117}

118_openssl_to_stdlib_verify = dict((v, k) for k, v in _stdlib_to_openssl_verify.items())

119

120# OpenSSL will only write 16K at a time

121SSL_WRITE_BLOCKSIZE = 16384

122

123orig_util_HAS_SNI = util.HAS_SNI

124orig_util_SSLContext = util.ssl_.SSLContext

125

126

127log = logging.getLogger(__name__)

128

129

130def inject_into_urllib3():

131 "Monkey-patch urllib3 with PyOpenSSL-backed SSL-support."

132

133 _validate_dependencies_met()

134

135 util.SSLContext = PyOpenSSLContext

136 util.ssl_.SSLContext = PyOpenSSLContext

137 util.HAS_SNI = HAS_SNI

138 util.ssl_.HAS_SNI = HAS_SNI

139 util.IS_PYOPENSSL = True

140 util.ssl_.IS_PYOPENSSL = True

141

142

143def extract_from_urllib3():

144 "Undo monkey-patching by :func:`inject_into_urllib3`."

145

146 util.SSLContext = orig_util_SSLContext

147 util.ssl_.SSLContext = orig_util_SSLContext

148 util.HAS_SNI = orig_util_HAS_SNI

149 util.ssl_.HAS_SNI = orig_util_HAS_SNI

150 util.IS_PYOPENSSL = False

151 util.ssl_.IS_PYOPENSSL = False

152

153

154def _validate_dependencies_met():

155 """

156 Verifies that PyOpenSSL's package-level dependencies have been met.

157 Throws `ImportError` if they are not met.

158 """

159 # Method added in `cryptography==1.1`; not available in older versions

160 from cryptography.x509.extensions import Extensions

161

162 if getattr(Extensions, "get_extension_for_class", None) is None:

163 raise ImportError(

164 "'cryptography' module missing required functionality. "

165 "Try upgrading to v1.3.4 or newer."

166 )

167

168 # pyOpenSSL 0.14 and above use cryptography for OpenSSL bindings. The _x509

169 # attribute is only present on those versions.

170 from OpenSSL.crypto import X509

171

172 x509 = X509()

173 if getattr(x509, "_x509", None) is None:

174 raise ImportError(

175 "'pyOpenSSL' module missing required functionality. "

176 "Try upgrading to v0.14 or newer."

177 )

178

179

180def _dnsname_to_stdlib(name):

181 """

182 Converts a dNSName SubjectAlternativeName field to the form used by the

183 standard library on the given Python version.

184

185 Cryptography produces a dNSName as a unicode string that was idna-decoded

186 from ASCII bytes. We need to idna-encode that string to get it back, and

187 then on Python 3 we also need to convert to unicode via UTF-8 (the stdlib

188 uses PyUnicode_FromStringAndSize on it, which decodes via UTF-8).

189

190 If the name cannot be idna-encoded then we return None signalling that

191 the name given should be skipped.

192 """

193

194 def idna_encode(name):

195 """

196 Borrowed wholesale from the Python Cryptography Project. It turns out

197 that we can't just safely call `idna.encode`: it can explode for

198 wildcard names. This avoids that problem.

199 """

200 import idna

201

202 try:

203 for prefix in [u"*.", u"."]:

204 if name.startswith(prefix):

205 name = name[len(prefix) :]

206 return prefix.encode("ascii") + idna.encode(name)

207 return idna.encode(name)

208 except idna.core.IDNAError:

209 return None

210

211 # Don't send IPv6 addresses through the IDNA encoder.

212 if ":" in name:

213 return name

214

215 name = idna_encode(name)

216 if name is None:

217 return None

218 elif sys.version_info >= (3, 0):

219 name = name.decode("utf-8")

220 return name

221

222

223def get_subj_alt_name(peer_cert):

224 """

225 Given an PyOpenSSL certificate, provides all the subject alternative names.

226 """

227 # Pass the cert to cryptography, which has much better APIs for this.

228 if hasattr(peer_cert, "to_cryptography"):

229 cert = peer_cert.to_cryptography()

230 else:

231 der = OpenSSL.crypto.dump_certificate(OpenSSL.crypto.FILETYPE_ASN1, peer_cert)

232 cert = x509.load_der_x509_certificate(der, openssl_backend)

233

234 # We want to find the SAN extension. Ask Cryptography to locate it (it's

235 # faster than looping in Python)

236 try:

237 ext = cert.extensions.get_extension_for_class(x509.SubjectAlternativeName).value

238 except x509.ExtensionNotFound:

239 # No such extension, return the empty list.

240 return []

241 except (

242 x509.DuplicateExtension,

243 UnsupportedExtension,

244 x509.UnsupportedGeneralNameType,

245 UnicodeError,

246 ) as e:

247 # A problem has been found with the quality of the certificate. Assume

248 # no SAN field is present.

249 log.warning(

250 "A problem was encountered with the certificate that prevented "

251 "urllib3 from finding the SubjectAlternativeName field. This can "

252 "affect certificate validation. The error was %s",

253 e,

254 )

255 return []

256

257 # We want to return dNSName and iPAddress fields. We need to cast the IPs

258 # back to strings because the match_hostname function wants them as

259 # strings.

260 # Sadly the DNS names need to be idna encoded and then, on Python 3, UTF-8

261 # decoded. This is pretty frustrating, but that's what the standard library

262 # does with certificates, and so we need to attempt to do the same.

263 # We also want to skip over names which cannot be idna encoded.

264 names = [

265 ("DNS", name)

266 for name in map(_dnsname_to_stdlib, ext.get_values_for_type(x509.DNSName))

267 if name is not None

268 ]

269 names.extend(

270 ("IP Address", str(name)) for name in ext.get_values_for_type(x509.IPAddress)

271 )

272

273 return names

274

275

276class WrappedSocket(object):

277 """API-compatibility wrapper for Python OpenSSL's Connection-class.

278

279 Note: _makefile_refs, _drop() and _reuse() are needed for the garbage

280 collector of pypy.

281 """

282

283 def __init__(self, connection, socket, suppress_ragged_eofs=True):

284 self.connection = connection

285 self.socket = socket

286 self.suppress_ragged_eofs = suppress_ragged_eofs

287 self._makefile_refs = 0

288 self._closed = False

289

290 def fileno(self):

291 return self.socket.fileno()

292

293 # Copy-pasted from Python 3.5 source code

294 def _decref_socketios(self):

295 if self._makefile_refs > 0:

296 self._makefile_refs -= 1

297 if self._closed:

298 self.close()

299

300 def recv(self, *args, **kwargs):

301 try:

302 data = self.connection.recv(*args, **kwargs)

303 except OpenSSL.SSL.SysCallError as e:

304 if self.suppress_ragged_eofs and e.args == (-1, "Unexpected EOF"):

305 return b""

306 else:

307 raise SocketError(str(e))

308 except OpenSSL.SSL.ZeroReturnError:

309 if self.connection.get_shutdown() == OpenSSL.SSL.RECEIVED_SHUTDOWN:

310 return b""

311 else:

312 raise

313 except OpenSSL.SSL.WantReadError:

314 if not util.wait_for_read(self.socket, self.socket.gettimeout()):

315 raise timeout("The read operation timed out")

316 else:

317 return self.recv(*args, **kwargs)

318

319 # TLS 1.3 post-handshake authentication

320 except OpenSSL.SSL.Error as e:

321 raise ssl.SSLError("read error: %r" % e)

322 else:

323 return data

324

325 def recv_into(self, *args, **kwargs):

326 try:

327 return self.connection.recv_into(*args, **kwargs)

328 except OpenSSL.SSL.SysCallError as e:

329 if self.suppress_ragged_eofs and e.args == (-1, "Unexpected EOF"):

330 return 0

331 else:

332 raise SocketError(str(e))

333 except OpenSSL.SSL.ZeroReturnError:

334 if self.connection.get_shutdown() == OpenSSL.SSL.RECEIVED_SHUTDOWN:

335 return 0

336 else:

337 raise

338 except OpenSSL.SSL.WantReadError:

339 if not util.wait_for_read(self.socket, self.socket.gettimeout()):

340 raise timeout("The read operation timed out")

341 else:

342 return self.recv_into(*args, **kwargs)

343

344 # TLS 1.3 post-handshake authentication

345 except OpenSSL.SSL.Error as e:

346 raise ssl.SSLError("read error: %r" % e)

347

348 def settimeout(self, timeout):

349 return self.socket.settimeout(timeout)

350

351 def _send_until_done(self, data):

352 while True:

353 try:

354 return self.connection.send(data)

355 except OpenSSL.SSL.WantWriteError:

356 if not util.wait_for_write(self.socket, self.socket.gettimeout()):

357 raise timeout()

358 continue

359 except OpenSSL.SSL.SysCallError as e:

360 raise SocketError(str(e))

361

362 def sendall(self, data):

363 total_sent = 0

364 while total_sent < len(data):

365 sent = self._send_until_done(

366 data[total_sent : total_sent + SSL_WRITE_BLOCKSIZE]

367 )

368 total_sent += sent

369

370 def shutdown(self):

371 # FIXME rethrow compatible exceptions should we ever use this

372 self.connection.shutdown()

373

374 def close(self):

375 if self._makefile_refs < 1:

376 try:

377 self._closed = True

378 return self.connection.close()

379 except OpenSSL.SSL.Error:

380 return

381 else:

382 self._makefile_refs -= 1

383

384 def getpeercert(self, binary_form=False):

385 x509 = self.connection.get_peer_certificate()

386

387 if not x509:

388 return x509

389

390 if binary_form:

391 return OpenSSL.crypto.dump_certificate(OpenSSL.crypto.FILETYPE_ASN1, x509)

392

393 return {

394 "subject": ((("commonName", x509.get_subject().CN),),),

395 "subjectAltName": get_subj_alt_name(x509),

396 }

397

398 def version(self):

399 return self.connection.get_protocol_version_name()

400

401 def _reuse(self):

402 self._makefile_refs += 1

403

404 def _drop(self):

405 if self._makefile_refs < 1:

406 self.close()

407 else:

408 self._makefile_refs -= 1

409

410

411if _fileobject: # Platform-specific: Python 2

412

413 def makefile(self, mode, bufsize=-1):

414 self._makefile_refs += 1

415 return _fileobject(self, mode, bufsize, close=True)

416

417else: # Platform-specific: Python 3

418 makefile = backport_makefile

419

420WrappedSocket.makefile = makefile

421

422

423class PyOpenSSLContext(object):

424 """

425 I am a wrapper class for the PyOpenSSL ``Context`` object. I am responsible

426 for translating the interface of the standard library ``SSLContext`` object

427 to calls into PyOpenSSL.

428 """

429

430 def __init__(self, protocol):

431 self.protocol = _openssl_versions[protocol]

432 self._ctx = OpenSSL.SSL.Context(self.protocol)

433 self._options = 0

434 self.check_hostname = False

435

436 @property

437 def options(self):

438 return self._options

439

440 @options.setter

441 def options(self, value):

442 self._options = value

443 self._ctx.set_options(value)

444

445 @property

446 def verify_mode(self):

447 return _openssl_to_stdlib_verify[self._ctx.get_verify_mode()]

448

449 @verify_mode.setter

450 def verify_mode(self, value):

451 self._ctx.set_verify(_stdlib_to_openssl_verify[value], _verify_callback)

452

453 def set_default_verify_paths(self):

454 self._ctx.set_default_verify_paths()

455

456 def set_ciphers(self, ciphers):

457 if isinstance(ciphers, six.text_type):

458 ciphers = ciphers.encode("utf-8")

459 self._ctx.set_cipher_list(ciphers)

460

461 def load_verify_locations(self, cafile=None, capath=None, cadata=None):

462 if cafile is not None:

463 cafile = cafile.encode("utf-8")

464 if capath is not None:

465 capath = capath.encode("utf-8")

466 try:

467 self._ctx.load_verify_locations(cafile, capath)

468 if cadata is not None:

469 self._ctx.load_verify_locations(BytesIO(cadata))

470 except OpenSSL.SSL.Error as e:

471 raise ssl.SSLError("unable to load trusted certificates: %r" % e)

472

473 def load_cert_chain(self, certfile, keyfile=None, password=None):

474 self._ctx.use_certificate_chain_file(certfile)

475 if password is not None:

476 if not isinstance(password, six.binary_type):

477 password = password.encode("utf-8")

478 self._ctx.set_passwd_cb(lambda *_: password)

479 self._ctx.use_privatekey_file(keyfile or certfile)

480

481 def set_alpn_protocols(self, protocols):

482 protocols = [six.ensure_binary(p) for p in protocols]

483 return self._ctx.set_alpn_protos(protocols)

484

485 def wrap_socket(

486 self,

487 sock,

488 server_side=False,

489 do_handshake_on_connect=True,

490 suppress_ragged_eofs=True,

491 server_hostname=None,

492 ):

493 cnx = OpenSSL.SSL.Connection(self._ctx, sock)

494

495 if isinstance(server_hostname, six.text_type): # Platform-specific: Python 3

496 server_hostname = server_hostname.encode("utf-8")

497

498 if server_hostname is not None:

499 cnx.set_tlsext_host_name(server_hostname)

500

501 cnx.set_connect_state()

502

503 while True:

504 try:

505 cnx.do_handshake()

506 except OpenSSL.SSL.WantReadError:

507 if not util.wait_for_read(sock, sock.gettimeout()):

508 raise timeout("select timed out")

509 continue

510 except OpenSSL.SSL.Error as e:

511 raise ssl.SSLError("bad handshake: %r" % e)

512 break

513

514 return WrappedSocket(cnx, sock)

515

516

517def _verify_callback(cnx, x509, err_no, err_depth, return_code):

518 return err_no == 0