crabapples
/
websockify
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Kept ssl.create_default_context, but added fallback to ssl.wrap_socket. This commit now incorporates #190 without breaking compatibility towards old Python versions. 

Removed test that cannot not work with new ssl.create_default_context.
This commit is contained in:
Hermann Höhne 2017-09-03 17:24:22 +02:00
parent a426020e04
commit 8cb3acd510
2 changed files with 29 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
tests/test_websockifyserver.py
View File

@ -257,21 +257,10 @@ class WebSockifyServerTestCase(unittest.TestCase):
sock, '127.0.0.1') sock, '127.0.0.1')
def test_do_handshake_ssl_error_eof_raises_close_error(self): def test_do_handshake_ssl_error_eof_raises_close_error(self):
server = self._get_server(daemon=True, ssl_only=0, idle_timeout=1) # TODO: re-implement this test.
# Test was incompatible with new style socket wrapping offered by
sock = FakeSocket("\x16some ssl data") # ssl.create_default_context.
pass
def fake_select(rlist, wlist, xlist, timeout=None):
return ([sock], [], [])
def fake_wrap_socket(*args, **kwargs):
raise ssl.SSLError(ssl.SSL_ERROR_EOF)
self.stubs.Set(select, 'select', fake_select)
self.stubs.Set(ssl, 'wrap_socket', fake_wrap_socket)
self.assertRaises(
websockifyserver.WebSockifyServer.EClose, server.do_handshake,
sock, '127.0.0.1')
def test_fallback_sigchld_handler(self): def test_fallback_sigchld_handler(self):
# TODO(directxman12): implement this # TODO(directxman12): implement this

35
websockify/websockifyserver.py
View File

@ -541,16 +541,31 @@ class WebSockifyServer(object):
% self.cert) % self.cert)
retsock = None retsock = None
try: try:
context = ssl.create_default_context(ssl.Purpose.CLIENT_AUTH) try:
context.load_cert_chain(certfile=self.cert, keyfile=self.key) # try creating new-style SSL wrapping for extended features
if self.verify_client: context = ssl.create_default_context(ssl.Purpose.CLIENT_AUTH)
context.verify_mode = ssl.CERT_REQUIRED context.load_cert_chain(certfile=self.cert, keyfile=self.key)
context.set_default_verify_paths() if self.verify_client:
if self.cafile: context.verify_mode = ssl.CERT_REQUIRED
context.load_verify_locations(cafile=self.cafile) context.set_default_verify_paths()
retsock = context.wrap_socket( if self.cafile:
sock, context.load_verify_locations(cafile=self.cafile)
server_side=True) retsock = context.wrap_socket(
sock,
server_side=True)
except AttributeError as ae:
if str(ae) != "'module' object has no attribute 'create_default_context'":
# this exception is not caused by create_default_context not existing in old version. re-raise exception to be handled somewhere elese.
raise
elif self.verify_client:
raise self.EClose("Client certificate verification requested, but not Python is too old.")
else:
# new-style SSL wrapping is not needed, falling back to old style
retsock = ssl.wrap_socket(
sock,
server_side=True,
certfile=self.cert,
keyfile=self.key)
except ssl.SSLError: except ssl.SSLError:
_, x, _ = sys.exc_info() _, x, _ = sys.exc_info()
if x.args[0] == ssl.SSL_ERROR_EOF: if x.args[0] == ssl.SSL_ERROR_EOF: