[Checkins] SVN: zc.ssl/trunk/ hostname verification
Patrick Strawderman
cvs-admin at zope.org
Mon Mar 4 15:16:10 UTC 2013
Log message for revision 130025:
hostname verification
Changed:
U zc.ssl/trunk/CHANGES.txt
U zc.ssl/trunk/bootstrap.py
U zc.ssl/trunk/buildout.cfg
U zc.ssl/trunk/setup.py
U zc.ssl/trunk/src/zc/ssl/__init__.py
U zc.ssl/trunk/src/zc/ssl/tests.py
U zc.ssl/trunk/src/zc/ssl/tests.txt
-=-
Modified: zc.ssl/trunk/CHANGES.txt
===================================================================
--- zc.ssl/trunk/CHANGES.txt 2013-03-04 15:15:37 UTC (rev 130024)
+++ zc.ssl/trunk/CHANGES.txt 2013-03-04 15:16:09 UTC (rev 130025)
@@ -1,10 +1,12 @@
1.3 (Unreleased)
================
-- Using Python's ``doctest`` module instead of deprecated
+- Use Python's ``doctest`` module instead of deprecated
``zope.testing.doctest``.
+- Add `source_address` parameter to zc.ssl.HTTPSConnection.__init__ to
+ match the signature of the httplib base class as of Python 2.7.
+- Perform certificate hostname verification.
-
1.2 (2010-04-07)
================
Modified: zc.ssl/trunk/bootstrap.py
===================================================================
--- zc.ssl/trunk/bootstrap.py 2013-03-04 15:15:37 UTC (rev 130024)
+++ zc.ssl/trunk/bootstrap.py 2013-03-04 15:16:09 UTC (rev 130025)
@@ -16,33 +16,247 @@
Simply run this script in a directory containing a buildout.cfg.
The script accepts buildout command-line options, so you can
use the -c option to specify an alternate configuration file.
-
-$Id$
"""
-import os, shutil, sys, tempfile, urllib2
+import os, shutil, sys, tempfile, urllib, urllib2, subprocess
+from optparse import OptionParser
-tmpeggs = tempfile.mkdtemp()
+if sys.platform == 'win32':
+ def quote(c):
+ if ' ' in c:
+ return '"%s"' % c # work around spawn lamosity on windows
+ else:
+ return c
+else:
+ quote = str
-ez = {}
-exec urllib2.urlopen('http://peak.telecommunity.com/dist/ez_setup.py'
- ).read() in ez
-ez['use_setuptools'](to_dir=tmpeggs, download_delay=0)
+# See zc.buildout.easy_install._has_broken_dash_S for motivation and comments.
+stdout, stderr = subprocess.Popen(
+ [sys.executable, '-Sc',
+ 'try:\n'
+ ' import ConfigParser\n'
+ 'except ImportError:\n'
+ ' print 1\n'
+ 'else:\n'
+ ' print 0\n'],
+ stdout=subprocess.PIPE, stderr=subprocess.PIPE).communicate()
+has_broken_dash_S = bool(int(stdout.strip()))
-import pkg_resources
+# In order to be more robust in the face of system Pythons, we want to
+# run without site-packages loaded. This is somewhat tricky, in
+# particular because Python 2.6's distutils imports site, so starting
+# with the -S flag is not sufficient. However, we'll start with that:
+if not has_broken_dash_S and 'site' in sys.modules:
+ # We will restart with python -S.
+ args = sys.argv[:]
+ args[0:0] = [sys.executable, '-S']
+ args = map(quote, args)
+ os.execv(sys.executable, args)
+# Now we are running with -S. We'll get the clean sys.path, import site
+# because distutils will do it later, and then reset the path and clean
+# out any namespace packages from site-packages that might have been
+# loaded by .pth files.
+clean_path = sys.path[:]
+import site # imported because of its side effects
+sys.path[:] = clean_path
+for k, v in sys.modules.items():
+ if k in ('setuptools', 'pkg_resources') or (
+ hasattr(v, '__path__') and
+ len(v.__path__) == 1 and
+ not os.path.exists(os.path.join(v.__path__[0], '__init__.py'))):
+ # This is a namespace package. Remove it.
+ sys.modules.pop(k)
+is_jython = sys.platform.startswith('java')
+
+setuptools_source = 'http://peak.telecommunity.com/dist/ez_setup.py'
+distribute_source = 'http://python-distribute.org/distribute_setup.py'
+
+
+# parsing arguments
+def normalize_to_url(option, opt_str, value, parser):
+ if value:
+ if '://' not in value: # It doesn't smell like a URL.
+ value = 'file://%s' % (
+ urllib.pathname2url(
+ os.path.abspath(os.path.expanduser(value))),)
+ if opt_str == '--download-base' and not value.endswith('/'):
+ # Download base needs a trailing slash to make the world happy.
+ value += '/'
+ else:
+ value = None
+ name = opt_str[2:].replace('-', '_')
+ setattr(parser.values, name, value)
+
+usage = '''\
+[DESIRED PYTHON FOR BUILDOUT] bootstrap.py [options]
+
+Bootstraps a buildout-based project.
+
+Simply run this script in a directory containing a buildout.cfg, using the
+Python that you want bin/buildout to use.
+
+Note that by using --setup-source and --download-base to point to
+local resources, you can keep this script from going over the network.
+'''
+
+parser = OptionParser(usage=usage)
+parser.add_option("-v", "--version", dest="version",
+ help="use a specific zc.buildout version")
+parser.add_option("-d", "--distribute",
+ action="store_true", dest="use_distribute", default=False,
+ help="Use Distribute rather than Setuptools.")
+parser.add_option("--setup-source", action="callback", dest="setup_source",
+ callback=normalize_to_url, nargs=1, type="string",
+ help=("Specify a URL or file location for the setup file. "
+ "If you use Setuptools, this will default to " +
+ setuptools_source + "; if you use Distribute, this "
+ "will default to " + distribute_source + "."))
+parser.add_option("--download-base", action="callback", dest="download_base",
+ callback=normalize_to_url, nargs=1, type="string",
+ help=("Specify a URL or directory for downloading "
+ "zc.buildout and either Setuptools or Distribute. "
+ "Defaults to PyPI."))
+parser.add_option("--eggs",
+ help=("Specify a directory for storing eggs. Defaults to "
+ "a temporary directory that is deleted when the "
+ "bootstrap script completes."))
+parser.add_option("-t", "--accept-buildout-test-releases",
+ dest='accept_buildout_test_releases',
+ action="store_true", default=False,
+ help=("Normally, if you do not specify a --version, the "
+ "bootstrap script and buildout gets the newest "
+ "*final* versions of zc.buildout and its recipes and "
+ "extensions for you. If you use this flag, "
+ "bootstrap and buildout will get the newest releases "
+ "even if they are alphas or betas."))
+parser.add_option("-c", None, action="store", dest="config_file",
+ help=("Specify the path to the buildout configuration "
+ "file to be used."))
+
+options, args = parser.parse_args()
+
+# if -c was provided, we push it back into args for buildout's main function
+if options.config_file is not None:
+ args += ['-c', options.config_file]
+
+if options.eggs:
+ eggs_dir = os.path.abspath(os.path.expanduser(options.eggs))
+else:
+ eggs_dir = tempfile.mkdtemp()
+
+if options.setup_source is None:
+ if options.use_distribute:
+ options.setup_source = distribute_source
+ else:
+ options.setup_source = setuptools_source
+
+if options.accept_buildout_test_releases:
+ args.append('buildout:accept-buildout-test-releases=true')
+args.append('bootstrap')
+
+try:
+ import pkg_resources
+ import setuptools # A flag. Sometimes pkg_resources is installed alone.
+ if not hasattr(pkg_resources, '_distribute'):
+ raise ImportError
+except ImportError:
+ ez_code = urllib2.urlopen(
+ options.setup_source).read().replace('\r\n', '\n')
+ ez = {}
+ exec ez_code in ez
+ setup_args = dict(to_dir=eggs_dir, download_delay=0)
+ if options.download_base:
+ setup_args['download_base'] = options.download_base
+ if options.use_distribute:
+ setup_args['no_fake'] = True
+ ez['use_setuptools'](**setup_args)
+ if 'pkg_resources' in sys.modules:
+ reload(sys.modules['pkg_resources'])
+ import pkg_resources
+ # This does not (always?) update the default working set. We will
+ # do it.
+ for path in sys.path:
+ if path not in pkg_resources.working_set.entries:
+ pkg_resources.working_set.add_entry(path)
+
+cmd = [quote(sys.executable),
+ '-c',
+ quote('from setuptools.command.easy_install import main; main()'),
+ '-mqNxd',
+ quote(eggs_dir)]
+
+if not has_broken_dash_S:
+ cmd.insert(1, '-S')
+
+find_links = options.download_base
+if not find_links:
+ find_links = os.environ.get('bootstrap-testing-find-links')
+if find_links:
+ cmd.extend(['-f', quote(find_links)])
+
+if options.use_distribute:
+ setup_requirement = 'distribute'
+else:
+ setup_requirement = 'setuptools'
ws = pkg_resources.working_set
-assert os.spawnle(
- os.P_WAIT, sys.executable, sys.executable,
- '-c', 'from setuptools.command.easy_install import main; main()',
- '-mqNxd', tmpeggs, 'zc.buildout',
- {'PYTHONPATH':
- ws.find(pkg_resources.Requirement.parse('setuptools')).location
- },
- ) == 0
+setup_requirement_path = ws.find(
+ pkg_resources.Requirement.parse(setup_requirement)).location
+env = dict(
+ os.environ,
+ PYTHONPATH=setup_requirement_path)
-ws.add_entry(tmpeggs)
-ws.require('zc.buildout')
+requirement = 'zc.buildout'
+version = options.version
+if version is None and not options.accept_buildout_test_releases:
+ # Figure out the most recent final version of zc.buildout.
+ import setuptools.package_index
+ _final_parts = '*final-', '*final'
+
+ def _final_version(parsed_version):
+ for part in parsed_version:
+ if (part[:1] == '*') and (part not in _final_parts):
+ return False
+ return True
+ index = setuptools.package_index.PackageIndex(
+ search_path=[setup_requirement_path])
+ if find_links:
+ index.add_find_links((find_links,))
+ req = pkg_resources.Requirement.parse(requirement)
+ if index.obtain(req) is not None:
+ best = []
+ bestv = None
+ for dist in index[req.project_name]:
+ distv = dist.parsed_version
+ if _final_version(distv):
+ if bestv is None or distv > bestv:
+ best = [dist]
+ bestv = distv
+ elif distv == bestv:
+ best.append(dist)
+ if best:
+ best.sort()
+ version = best[-1].version
+if version:
+ requirement = '=='.join((requirement, version))
+cmd.append(requirement)
+
+if is_jython:
+ import subprocess
+ exitcode = subprocess.Popen(cmd, env=env).wait()
+else: # Windows prefers this, apparently; otherwise we would prefer subprocess
+ exitcode = os.spawnle(*([os.P_WAIT, sys.executable] + cmd + [env]))
+if exitcode != 0:
+ sys.stdout.flush()
+ sys.stderr.flush()
+ print ("An error occurred when trying to install zc.buildout. "
+ "Look above this message for any errors that "
+ "were output by easy_install.")
+ sys.exit(exitcode)
+
+ws.add_entry(eggs_dir)
+ws.require(requirement)
import zc.buildout.buildout
-zc.buildout.buildout.main(sys.argv[1:] + ['bootstrap'])
-shutil.rmtree(tmpeggs)
+zc.buildout.buildout.main(args)
+if not options.eggs: # clean up temporary egg directory
+ shutil.rmtree(eggs_dir)
Modified: zc.ssl/trunk/buildout.cfg
===================================================================
--- zc.ssl/trunk/buildout.cfg 2013-03-04 15:15:37 UTC (rev 130024)
+++ zc.ssl/trunk/buildout.cfg 2013-03-04 15:16:09 UTC (rev 130025)
@@ -5,8 +5,8 @@
[mypython]
recipe = zc.recipe.egg
interpreter = python
-eggs = zc.ssl
+eggs = zc.ssl [test]
[test]
recipe = zc.recipe.testrunner
-eggs = zc.ssl
+eggs = zc.ssl [test]
Modified: zc.ssl/trunk/setup.py
===================================================================
--- zc.ssl/trunk/setup.py 2013-03-04 15:15:37 UTC (rev 130024)
+++ zc.ssl/trunk/setup.py 2013-03-04 15:16:09 UTC (rev 130025)
@@ -2,8 +2,8 @@
from setuptools import setup, find_packages
install_requires = [
+ 'backports.ssl_match_hostname',
'setuptools',
- 'zope.testing',
]
if sys.version_info < (2, 6, 0):
@@ -22,6 +22,6 @@
package_dir = {'':'src'},
namespace_packages = ['zc'],
install_requires = install_requires,
- dependency_links = ['http://download.zope.org/distribution/'],
+ extras_require=dict(test=[]),
license = "ZPL 2.1",
)
Modified: zc.ssl/trunk/src/zc/ssl/__init__.py
===================================================================
--- zc.ssl/trunk/src/zc/ssl/__init__.py 2013-03-04 15:15:37 UTC (rev 130024)
+++ zc.ssl/trunk/src/zc/ssl/__init__.py 2013-03-04 15:16:09 UTC (rev 130025)
@@ -11,25 +11,26 @@
import os.path
import sys
+from backports.ssl_match_hostname import match_hostname, CertificateError
+cert_path = os.path.join(os.path.dirname(__file__), "certs.pem")
+
class HTTPSConnection(httplib.HTTPSConnection):
"""An HTTPS connection using the ssl module"""
def __init__(self, host, port=None, key_file=None, cert_file=None,
- strict=None, timeout=None):
- if sys.version_info < (2, 6, 0):
- # timeout is None or float
+ strict=None, timeout=None, source_address=None):
+ if cert_file is None:
+ cert_file = cert_path
+ args = [host, port, key_file, cert_file, strict]
+ if sys.version_info >= (2, 6, 0):
+ args.append(timeout)
+ else:
self.timeout = timeout
- httplib.HTTPSConnection.__init__(
- self, host, port, key_file, cert_file, strict)
- else:
- httplib.HTTPSConnection.__init__(
- self, host, port, key_file, cert_file, strict, timeout)
+ if sys.version_info >= (2, 7, 0):
+ args.append(source_address)
+ httplib.HTTPSConnection.__init__(self, *args)
- if self.cert_file is None:
- self.cert_file = os.path.join(os.path.dirname(__file__),
- "certs.pem")
-
ssl_wrap_socket = staticmethod(ssl.wrap_socket)
def connect(self):
@@ -40,3 +41,5 @@
cert_reqs=ssl.CERT_REQUIRED)
self.sock.settimeout(self.timeout)
self.sock.connect((self.host, self.port))
+ import pdb; pdb.set_trace()
+ match_hostname(self.sock.getpeercert(), self.host)
Modified: zc.ssl/trunk/src/zc/ssl/tests.py
===================================================================
--- zc.ssl/trunk/src/zc/ssl/tests.py 2013-03-04 15:15:37 UTC (rev 130024)
+++ zc.ssl/trunk/src/zc/ssl/tests.py 2013-03-04 15:16:09 UTC (rev 130025)
@@ -2,30 +2,54 @@
$Id$
"""
+import doctest
+import shutil
+import os
+import os.path
+import tempfile
import unittest
-import doctest
+import zc.ssl
-class StubSSLWrapper(object):
- def __init__(self, sock, ca_certs=None, cert_reqs=None):
- self.sock = sock
- self.ca_certs = ca_certs
- self.cert_reqs = cert_reqs
- print "sssl(%r, %r, %r)" % (sock, ca_certs, cert_reqs)
+class CertErrorConnection(zc.ssl.HTTPSConnection, object):
- def settimeout(self, timeout):
- print "sssl.settimeout(%r)" % timeout
+ count = 0
+ _host = None
- def connect(self, hostport):
- print "sssl.connect(%r)" % (hostport, )
+ @property
+ def host(self):
+ # The connect method access self.host twice, so on the second access
+ # we'll return a different hostname to simulate a cert name mismatch
+ res = self._host
+ if self.count:
+ res = "zope.com"
+ self.count += 1
+ return res
+ @host.setter
+ def host(self, val):
+ self._host = val
+
+def setUp(test):
+ fd, cert_path = tempfile.mkstemp()
+ os.close(fd)
+ shutil.copyfile(zc.ssl.cert_path, cert_path)
+ test.globs["CertErrorConnection"] = CertErrorConnection
+ test.globs["cert_path"] = cert_path
+ test.globs["host"] = "httpbin.org"
+
+def tearDown(test):
+ os.remove(test.globs["cert_path"])
+
def test_suite():
suite = unittest.TestSuite([
doctest.DocFileSuite(
'tests.txt',
- optionflags=doctest.ELLIPSIS),
+ optionflags=doctest.ELLIPSIS,
+ setUp=setUp,
+ tearDown=tearDown)
])
return suite
Modified: zc.ssl/trunk/src/zc/ssl/tests.txt
===================================================================
--- zc.ssl/trunk/src/zc/ssl/tests.txt 2013-03-04 15:15:37 UTC (rev 130024)
+++ zc.ssl/trunk/src/zc/ssl/tests.txt 2013-03-04 15:16:09 UTC (rev 130025)
@@ -2,24 +2,46 @@
Unit tests for HTTPSConnection
==============================
- >>> import zc.ssl.tests
+ >>> import httplib
+ >>> import ssl
>>> import zc.ssl
- >>> sssl = zc.ssl.HTTPSConnection(
- ... "creditcard.company", 443, None, "/etc/certs.pem", None, 3.14)
- >>> sssl.ssl_wrap_socket = zc.ssl.tests.StubSSLWrapper
+ >>> conn = zc.ssl.HTTPSConnection(
+ ... host=host, port=443, key_file=None, cert_file=cert_path,
+ ... timeout=23.1, source_address=None)
The connect method sets the socket's timeout and invokes its
connect method:
- >>> sssl.connect()
- sssl(<socket._socketobject object at ...>, '/etc/certs.pem', 2)
- sssl.settimeout(3.1400000000000001)
- sssl.connect(('creditcard.company', 443))
+ >>> conn.connect()
+ >>> sock = conn.sock
+ >>> sock.ca_certs == cert_path
+ True
+ >>> sock.cert_reqs == ssl.CERT_REQUIRED
+ True
+Everything else works as expected.
+
+ >>> conn.request("GET", "/get")
+ >>> response = conn.getresponse()
+ >>> response.status
+ 200
+ >>> len(response.read()) == int(response.getheader("Content-Length"))
+ True
+ >>> conn.close()
+
+If the certificate hostname doesn't match the host we are connecting to,
+an exception is raised.
+
+ >>> conn = CertErrorConnection(host)
+ >>> conn.connect() # doctest: +ELLIPSIS
+ Traceback (most recent call last):
+ ...
+ CertificateError: hostname 'zope.com' doesn't match 'httpbin.org'
+
When the certificate file is not provided, the default one is used:
- >>> sssl = zc.ssl.HTTPSConnection("creditcard.company")
- >>> sssl.cert_file
+ >>> conn = zc.ssl.HTTPSConnection(host)
+ >>> conn.cert_file
'.../src/zc/ssl/certs.pem'
- >>> file(sssl.cert_file)
+ >>> open(conn.cert_file)
<open file ...>
More information about the checkins
mailing list