6c7df68c7c
* Initial support for using multiple SSL certificates. * Also list IP address subjectAltNames on log. * Use Python 3.7+ way of specifying TLSv1.2 as the minimum version. Linter fixes. * isort * Cleanup, store server name for later use. Add RSA ciphers. Log rejected SNIs. * Cleanup, linter. * Alter the order of initial log messages and handling. In particular, enable debug mode early so that debug messages during init can be shown. * Store server name (SNI) to conn_info. * Update test with new error message. * Refactor for readability. * Cleanup * Replace old expired test cert with new ones and a script for regenerating them as needed. * Refactor TLS tests to a separate file. * Add cryptography to dev deps for rebuilding TLS certs. * Minor adjustment to messages. * Tests added for new TLS code. * Find the correct log row before testing for message. The order was different on CI. * More log message order fixup. The tests do not account for the logo being printed first. * Another attempt at log message indexing fixup. * Major TLS refactoring. CertSelector now allows dicts and SSLContext within its list. Server names are stored even when no list is used. SSLContext.sanic now contains a dict with any setting passed and information extracted from cert. That information is available on request.conn_info.cert. Type annotations added. More tests incl. a handler for faking hostname in tests. * Remove a problematic logger test that apparently was not adding any coverage or value to anything. * Revert accidental commit of uvloop disable. * Typing fixes / refactoring. * Additional test for cert selection. Certs recreated without DNS:localhost on sanic.example cert. * Add tests for single certificate path shorthand and SNI information. * Move TLS dict processing to CertSimple, make the names field optional and use names from the cert if absent. * Sanic CLI options --tls and --tls-strict-host to use the new features. * SSL argument typing updated * Use ValueError for internal message passing to avoid CertificateError's odd message formatting. * Linter * Test CLI TLS options. * Maybe the right codeclimate option now... * Improved TLS argument help, removed support for combining --cert/--key with --tls. * Removed support for strict checking without any certs, black forced fscked up formatting. * Update CLI tests for stricter TLS options. Co-authored-by: L. Karkkainen <tronic@users.noreply.github.com> Co-authored-by: Adam Hopkins <admhpkns@gmail.com>
114 lines
3.0 KiB
Python
114 lines
3.0 KiB
Python
from datetime import datetime, timedelta
|
|
from ipaddress import ip_address
|
|
from os import path
|
|
|
|
from cryptography.hazmat.primitives import hashes, serialization
|
|
from cryptography.hazmat.primitives.asymmetric import ec, rsa
|
|
from cryptography.x509 import (
|
|
BasicConstraints,
|
|
CertificateBuilder,
|
|
DNSName,
|
|
ExtendedKeyUsage,
|
|
IPAddress,
|
|
KeyUsage,
|
|
Name,
|
|
NameAttribute,
|
|
SubjectAlternativeName,
|
|
random_serial_number,
|
|
)
|
|
from cryptography.x509.oid import ExtendedKeyUsageOID, NameOID
|
|
|
|
|
|
def writefiles(key, cert):
|
|
cn = cert.subject.get_attributes_for_oid(NameOID.COMMON_NAME)[0].value
|
|
folder = path.join(path.dirname(__file__), cn)
|
|
with open(path.join(folder, "fullchain.pem"), "wb") as f:
|
|
f.write(cert.public_bytes(serialization.Encoding.PEM))
|
|
|
|
with open(path.join(folder, "privkey.pem"), "wb") as f:
|
|
f.write(
|
|
key.private_bytes(
|
|
serialization.Encoding.PEM,
|
|
serialization.PrivateFormat.TraditionalOpenSSL,
|
|
serialization.NoEncryption(),
|
|
)
|
|
)
|
|
|
|
|
|
def selfsigned(key, common_name, san):
|
|
subject = issuer = Name(
|
|
[
|
|
NameAttribute(NameOID.COMMON_NAME, common_name),
|
|
NameAttribute(NameOID.ORGANIZATION_NAME, "Sanic Org"),
|
|
]
|
|
)
|
|
cert = (
|
|
CertificateBuilder()
|
|
.subject_name(subject)
|
|
.issuer_name(issuer)
|
|
.public_key(key.public_key())
|
|
.serial_number(random_serial_number())
|
|
.not_valid_before(datetime.utcnow())
|
|
.not_valid_after(datetime.utcnow() + timedelta(days=365.25 * 8))
|
|
.add_extension(
|
|
KeyUsage(
|
|
True, False, False, False, False, False, False, False, False
|
|
),
|
|
critical=True,
|
|
)
|
|
.add_extension(
|
|
ExtendedKeyUsage(
|
|
[
|
|
ExtendedKeyUsageOID.SERVER_AUTH,
|
|
ExtendedKeyUsageOID.CLIENT_AUTH,
|
|
]
|
|
),
|
|
critical=False,
|
|
)
|
|
.add_extension(
|
|
BasicConstraints(ca=True, path_length=None),
|
|
critical=True,
|
|
)
|
|
.add_extension(
|
|
SubjectAlternativeName(
|
|
[
|
|
IPAddress(ip_address(n))
|
|
if n[0].isdigit() or ":" in n
|
|
else DNSName(n)
|
|
for n in san
|
|
]
|
|
),
|
|
critical=False,
|
|
)
|
|
.sign(key, hashes.SHA256())
|
|
)
|
|
return cert
|
|
|
|
|
|
# Sanic example/test self-signed cert RSA
|
|
key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
|
|
cert = selfsigned(
|
|
key,
|
|
"sanic.example",
|
|
[
|
|
"sanic.example",
|
|
"www.sanic.example",
|
|
"*.sanic.test",
|
|
"2001:db8::541c",
|
|
],
|
|
)
|
|
writefiles(key, cert)
|
|
|
|
# Sanic localhost self-signed cert ECDSA
|
|
key = ec.generate_private_key(ec.SECP256R1)
|
|
cert = selfsigned(
|
|
key,
|
|
"localhost",
|
|
[
|
|
"localhost",
|
|
"127.0.0.1",
|
|
"::1",
|
|
],
|
|
)
|
|
writefiles(key, cert)
|