Skip to content

Commit 96677e5

Browse files
xiazhveraxiazhvera
committed
move cipher suite to builder option
1 parent a2e9100 commit 96677e5

File tree

2 files changed

+12
-42
lines changed

2 files changed

+12
-42
lines changed

‎awsiot/mqtt5_client_builder.py‎

Lines changed: 7 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -243,6 +243,7 @@ def _builder(
243243
use_websockets=False,
244244
websocket_handshake_transform=None,
245245
use_custom_authorizer=False,
246+
cipher_pref=awscrt.io.TlsCipherPref.DEFAULT,
246247
**kwargs):
247248

248249
username = _get(kwargs, 'username', '')
@@ -345,6 +346,9 @@ def _builder(
345346
elif ca_filepath or ca_dirpath:
346347
tls_ctx_options.override_default_trust_store_from_path(ca_dirpath, ca_filepath)
347348

349+
if cipher_pref is not None:
350+
tls_ctx_options.cipher_pref = cipher_pref
351+
348352
if client_options.port is None:
349353
# prefer 443, even for direct MQTT connections, since it's less likely to be blocked by firewalls
350354
if use_websockets or awscrt.io.is_alpn_available():
@@ -362,7 +366,7 @@ def _builder(
362366
return client
363367

364368

365-
def mtls_from_path(cert_filepath, pri_key_filepath, cipher_pref=awscrt.io.TlsCipherPref.DEFAULT,
369+
def mtls_from_path(cert_filepath, pri_key_filepath,
366370
**kwargs) -> awscrt.mqtt5.Client:
367371
"""
368372
This builder creates an :class:`awscrt.mqtt5.Client`, configured for an mTLS MQTT5 Client to AWS IoT.
@@ -378,14 +382,12 @@ def mtls_from_path(cert_filepath, pri_key_filepath, cipher_pref=awscrt.io.TlsCip
378382
"""
379383
_check_required_kwargs(**kwargs)
380384
tls_ctx_options = awscrt.io.TlsContextOptions.create_client_with_mtls_from_path(cert_filepath, pri_key_filepath)
381-
tls_ctx_options.cipher_pref = cipher_pref
382385
return _builder(tls_ctx_options, **kwargs)
383386

384387

385388
def mtls_from_bytes(
386389
cert_bytes,
387390
pri_key_bytes,
388-
cipher_pref=awscrt.io.TlsCipherPref.DEFAULT,
389391
**kwargs) -> awscrt.mqtt5.Client:
390392
"""
391393
This builder creates an :class:`awscrt.mqtt5.Client`, configured for an mTLS MQTT5 Client to AWS IoT.
@@ -401,7 +403,6 @@ def mtls_from_bytes(
401403
"""
402404
_check_required_kwargs(**kwargs)
403405
tls_ctx_options = awscrt.io.TlsContextOptions.create_client_with_mtls(cert_bytes, pri_key_bytes)
404-
tls_ctx_options.cipher_pref = cipher_pref
405406
return _builder(tls_ctx_options, **kwargs)
406407

407408

@@ -413,7 +414,6 @@ def mtls_with_pkcs11(*,
413414
private_key_label: str = None,
414415
cert_filepath: str = None,
415416
cert_bytes=None,
416-
cipher_pref=awscrt.io.TlsCipherPref.DEFAULT,
417417
**kwargs) -> awscrt.mqtt5.Client:
418418
"""
419419
This builder creates an :class:`awscrt.mqtt5.Client`, configured for an mTLS MQTT connection to AWS IoT,
@@ -459,14 +459,12 @@ def mtls_with_pkcs11(*,
459459
private_key_label=private_key_label,
460460
cert_file_path=cert_filepath,
461461
cert_file_contents=cert_bytes)
462-
tls_ctx_options.cipher_pref = cipher_pref
463462
return _builder(tls_ctx_options, **kwargs)
464463

465464

466465
def mtls_with_pkcs12(*,
467466
pkcs12_filepath: str,
468467
pkcs12_password: str,
469-
cipher_pref=awscrt.io.TlsCipherPref.DEFAULT,
470468
**kwargs) -> awscrt.mqtt.Connection:
471469
"""
472470
This builder creates an :class:`awscrt.mqtt.Connection`, configured for an mTLS MQTT connection to AWS IoT,
@@ -487,13 +485,11 @@ def mtls_with_pkcs12(*,
487485
tls_ctx_options = awscrt.io.TlsContextOptions.create_client_with_mtls_pkcs12(
488486
pkcs12_filepath=pkcs12_filepath,
489487
pkcs12_password=pkcs12_password)
490-
tls_ctx_options.cipher_pref = cipher_pref
491488
return _builder(tls_ctx_options, **kwargs)
492489

493490

494491
def mtls_with_windows_cert_store_path(*,
495492
cert_store_path: str,
496-
cipher_pref=awscrt.io.TlsCipherPref.DEFAULT,
497493
**kwargs) -> awscrt.mqtt5.Client:
498494
"""
499495
This builder creates an :class:`awscrt.mqtt5.Client`, configured for an mTLS MQTT5 Client to AWS IoT,
@@ -512,15 +508,13 @@ def mtls_with_windows_cert_store_path(*,
512508
_check_required_kwargs(**kwargs)
513509

514510
tls_ctx_options = awscrt.io.TlsContextOptions.create_client_with_mtls_windows_cert_store_path(cert_store_path)
515-
tls_ctx_options.cipher_pref = cipher_pref
516511
return _builder(tls_ctx_options, **kwargs)
517512

518513

519514
def websockets_with_default_aws_signing(
520515
region,
521516
credentials_provider,
522517
websocket_proxy_options=None,
523-
cipher_pref=awscrt.io.TlsCipherPref.DEFAULT,
524518
**kwargs) -> awscrt.mqtt5.Client:
525519
"""
526520
This builder creates an :class:`awscrt.mqtt5.Client`, configured for an MQTT5 Client over websockets to AWS IoT.
@@ -560,15 +554,13 @@ def _sign_websocket_handshake_request(transform_args, **kwargs):
560554

561555
return websockets_with_custom_handshake(
562556
_sign_websocket_handshake_request,
563-
websocket_proxy_options = websocket_proxy_options,
564-
cipher_pref = cipher_pref,
557+
websocket_proxy_options,
565558
**kwargs)
566559

567560

568561
def websockets_with_custom_handshake(
569562
websocket_handshake_transform,
570563
websocket_proxy_options=None,
571-
cipher_pref=awscrt.io.TlsCipherPref.DEFAULT,
572564
**kwargs) -> awscrt.mqtt5.Client:
573565
"""
574566
This builder creates an :class:`awscrt.mqtt5.Client`, configured for an MQTT5 Client over websockets,
@@ -596,7 +588,6 @@ def websockets_with_custom_handshake(
596588
"""
597589
_check_required_kwargs(**kwargs)
598590
tls_ctx_options = awscrt.io.TlsContextOptions()
599-
tls_ctx_options.cipher_pref = cipher_pref
600591
return _builder(tls_ctx_options=tls_ctx_options,
601592
use_websockets=True,
602593
websocket_handshake_transform=websocket_handshake_transform,
@@ -628,7 +619,6 @@ def direct_with_custom_authorizer(
628619
auth_password=None,
629620
auth_token_key_name=None,
630621
auth_token_value=None,
631-
cipher_pref=awscrt.io.TlsCipherPref.DEFAULT,
632622
**kwargs) -> awscrt.mqtt5.Client:
633623
"""
634624
This builder creates an :class:`awscrt.mqtt5.Client`, configured for an MQTT5 Client using a custom
@@ -695,7 +685,6 @@ def direct_with_custom_authorizer(
695685

696686
tls_ctx_options = awscrt.io.TlsContextOptions()
697687
tls_ctx_options.alpn_list = ["mqtt"]
698-
tls_ctx_options.cipher_pref = cipher_pref
699688

700689
return _builder(tls_ctx_options=tls_ctx_options,
701690
use_websockets=False,
@@ -711,7 +700,6 @@ def websockets_with_custom_authorizer(
711700
websocket_proxy_options=None,
712701
auth_token_key_name=None,
713702
auth_token_value=None,
714-
cipher_pref=awscrt.io.TlsCipherPref.DEFAULT,
715703
**kwargs) -> awscrt.mqtt5.Client:
716704
"""
717705
This builder creates an :class:`awscrt.mqtt5.Client`, configured for an MQTT5 Client using a custom
@@ -781,7 +769,6 @@ def websockets_with_custom_authorizer(
781769
kwargs["password"] = auth_password
782770

783771
tls_ctx_options = awscrt.io.TlsContextOptions()
784-
tls_ctx_options.cipher_pref = cipher_pref
785772

786773
def _sign_websocket_handshake_request(transform_args, **kwargs):
787774
# transform_args need to know when transform is done
@@ -798,7 +785,7 @@ def _sign_websocket_handshake_request(transform_args, **kwargs):
798785
**kwargs)
799786

800787

801-
def new_default_builder(cipher_pref=awscrt.io.TlsCipherPref.DEFAULT, **kwargs) -> awscrt.mqtt5.Client:
788+
def new_default_builder(**kwargs) -> awscrt.mqtt5.Client:
802789
"""
803790
This builder creates an :class:`awscrt.mqtt5.Client`, without any configuration besides the default TLS context options.
804791
@@ -807,7 +794,6 @@ def new_default_builder(cipher_pref=awscrt.io.TlsCipherPref.DEFAULT, **kwargs) -
807794
"""
808795
_check_required_kwargs(**kwargs)
809796
tls_ctx_options = awscrt.io.TlsContextOptions()
810-
tls_ctx_options.cipher_pref = cipher_pref
811797
return _builder(tls_ctx_options=tls_ctx_options,
812798
use_websockets=False,
813799
**kwargs)

‎awsiot/mqtt_connection_builder.py‎

Lines changed: 5 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -181,6 +181,7 @@ def _builder(
181181
use_websockets=False,
182182
websocket_handshake_transform=None,
183183
use_custom_authorizer=False,
184+
cipher_pref=awscrt.io.TlsCipherPref.DEFAULT,
184185
**kwargs):
185186

186187
ca_bytes = _get(kwargs, 'ca_bytes')
@@ -202,6 +203,9 @@ def _builder(
202203
if port == 443 and awscrt.io.is_alpn_available() and use_custom_authorizer is False:
203204
tls_ctx_options.alpn_list = ['http/1.1'] if use_websockets else ['x-amzn-mqtt-ca']
204205

206+
if cipher_pref != awscrt.io.TlsCipherPref.DEFAULT:
207+
tls_ctx_options.cipher_pref = cipher_pref
208+
205209
socket_options = awscrt.io.SocketOptions()
206210
socket_options.connect_timeout_ms = _get(kwargs, 'tcp_connect_timeout_ms', 5000)
207211
# These have been inconsistent between keepalive/keep_alive. Resolve both for now to ease transition.
@@ -261,7 +265,6 @@ def _builder(
261265
def mtls_from_path(
262266
cert_filepath,
263267
pri_key_filepath,
264-
cipher_pref=awscrt.io.TlsCipherPref.DEFAULT,
265268
**kwargs) -> awscrt.mqtt.Connection:
266269
"""
267270
This builder creates an :class:`awscrt.mqtt.Connection`, configured for an mTLS MQTT connection to AWS IoT.
@@ -277,14 +280,12 @@ def mtls_from_path(
277280
"""
278281
_check_required_kwargs(**kwargs)
279282
tls_ctx_options = awscrt.io.TlsContextOptions.create_client_with_mtls_from_path(cert_filepath, pri_key_filepath)
280-
tls_ctx_options.cipher_pref = cipher_pref
281283
return _builder(tls_ctx_options, **kwargs)
282284

283285

284286
def mtls_from_bytes(
285287
cert_bytes,
286288
pri_key_bytes,
287-
cipher_pref=awscrt.io.TlsCipherPref.DEFAULT,
288289
**kwargs) -> awscrt.mqtt.Connection:
289290
"""
290291
This builder creates an :class:`awscrt.mqtt.Connection`, configured for an mTLS MQTT connection to AWS IoT.
@@ -300,7 +301,6 @@ def mtls_from_bytes(
300301
"""
301302
_check_required_kwargs(**kwargs)
302303
tls_ctx_options = awscrt.io.TlsContextOptions.create_client_with_mtls(cert_bytes, pri_key_bytes)
303-
tls_ctx_options.cipher_pref = cipher_pref
304304
return _builder(tls_ctx_options, **kwargs)
305305

306306

@@ -312,7 +312,6 @@ def mtls_with_pkcs11(*,
312312
private_key_label: str = None,
313313
cert_filepath: str = None,
314314
cert_bytes=None,
315-
cipher_pref=awscrt.io.TlsCipherPref.DEFAULT,
316315
**kwargs) -> awscrt.mqtt.Connection:
317316
"""
318317
This builder creates an :class:`awscrt.mqtt.Connection`, configured for an mTLS MQTT connection to AWS IoT,
@@ -358,15 +357,13 @@ def mtls_with_pkcs11(*,
358357
private_key_label=private_key_label,
359358
cert_file_path=cert_filepath,
360359
cert_file_contents=cert_bytes)
361-
tls_ctx_options.cipher_pref = cipher_pref
362360

363361
return _builder(tls_ctx_options, **kwargs)
364362

365363

366364
def mtls_with_pkcs12(*,
367365
pkcs12_filepath: str,
368366
pkcs12_password: str,
369-
cipher_pref=awscrt.io.TlsCipherPref.DEFAULT,
370367
**kwargs) -> awscrt.mqtt.Connection:
371368
"""
372369
This builder creates an :class:`awscrt.mqtt.Connection`, configured for an mTLS MQTT connection to AWS IoT,
@@ -387,13 +384,11 @@ def mtls_with_pkcs12(*,
387384
tls_ctx_options = awscrt.io.TlsContextOptions.create_client_with_mtls_pkcs12(
388385
pkcs12_filepath=pkcs12_filepath,
389386
pkcs12_password=pkcs12_password)
390-
tls_ctx_options.cipher_pref = cipher_pref
391387
return _builder(tls_ctx_options, **kwargs)
392388

393389

394390
def mtls_with_windows_cert_store_path(*,
395391
cert_store_path: str,
396-
cipher_pref=awscrt.io.TlsCipherPref.DEFAULT,
397392
**kwargs) -> awscrt.mqtt.Connection:
398393
"""
399394
This builder creates an :class:`awscrt.mqtt.Connection`, configured for an mTLS MQTT connection to AWS IoT,
@@ -412,7 +407,6 @@ def mtls_with_windows_cert_store_path(*,
412407
_check_required_kwargs(**kwargs)
413408

414409
tls_ctx_options = awscrt.io.TlsContextOptions.create_client_with_mtls_windows_cert_store_path(cert_store_path)
415-
tls_ctx_options.cipher_pref = cipher_pref
416410

417411
return _builder(tls_ctx_options, **kwargs)
418412

@@ -421,7 +415,6 @@ def websockets_with_default_aws_signing(
421415
region,
422416
credentials_provider,
423417
websocket_proxy_options=None,
424-
cipher_pref=awscrt.io.TlsCipherPref.DEFAULT,
425418
**kwargs) -> awscrt.mqtt.Connection:
426419
"""
427420
This builder creates an :class:`awscrt.mqtt.Connection`, configured for an MQTT connection over websockets to AWS IoT.
@@ -461,15 +454,13 @@ def _sign_websocket_handshake_request(transform_args, **kwargs):
461454

462455
return websockets_with_custom_handshake(
463456
_sign_websocket_handshake_request,
464-
websocket_proxy_options = websocket_proxy_options,
465-
cipher_pref = cipher_pref,
457+
websocket_proxy_options=websocket_proxy_options,
466458
**kwargs)
467459

468460

469461
def websockets_with_custom_handshake(
470462
websocket_handshake_transform,
471463
websocket_proxy_options=None,
472-
cipher_pref=awscrt.io.TlsCipherPref.DEFAULT,
473464
**kwargs) -> awscrt.mqtt.Connection:
474465
"""
475466
This builder creates an :class:`awscrt.mqtt.Connection`, configured for an MQTT connection over websockets,
@@ -497,7 +488,6 @@ def websockets_with_custom_handshake(
497488
"""
498489
_check_required_kwargs(**kwargs)
499490
tls_ctx_options = awscrt.io.TlsContextOptions()
500-
tls_ctx_options.cipher_pref = cipher_pref
501491
return _builder(tls_ctx_options=tls_ctx_options,
502492
use_websockets=True,
503493
websocket_handshake_transform=websocket_handshake_transform,
@@ -529,7 +519,6 @@ def direct_with_custom_authorizer(
529519
auth_password=None,
530520
auth_token_key_name=None,
531521
auth_token_value=None,
532-
cipher_pref=awscrt.io.TlsCipherPref.DEFAULT,
533522
**kwargs) -> awscrt.mqtt.Connection:
534523
"""
535524
This builder creates an :class:`awscrt.mqtt.Connection`, configured for an MQTT connection using a custom
@@ -575,7 +564,6 @@ def direct_with_custom_authorizer(
575564
auth_token_key_name=auth_token_key_name,
576565
auth_token_value=auth_token_value,
577566
use_websockets=False,
578-
cipher_pref=awscrt.io.TlsCipherPref.DEFAULT,
579567
**kwargs)
580568

581569

@@ -588,7 +576,6 @@ def websockets_with_custom_authorizer(
588576
auth_password=None,
589577
auth_token_key_name=None,
590578
auth_token_value=None,
591-
cipher_pref=awscrt.io.TlsCipherPref.DEFAULT,
592579
**kwargs) -> awscrt.mqtt.Connection:
593580
"""
594581
This builder creates an :class:`awscrt.mqtt.Connection`, configured for an MQTT connection using a custom
@@ -640,7 +627,6 @@ def websockets_with_custom_authorizer(
640627
use_websockets=True,
641628
websockets_region=region,
642629
websockets_credentials_provider=credentials_provider,
643-
cipher_pref=awscrt.io.TlsCipherPref.DEFAULT,
644630
**kwargs)
645631

646632

@@ -653,7 +639,6 @@ def _with_custom_authorizer(auth_username=None,
653639
use_websockets=False,
654640
websockets_credentials_provider=None,
655641
websockets_region=None,
656-
cipher_pref=awscrt.io.TlsCipherPref.DEFAULT,
657642
**kwargs) -> awscrt.mqtt.Connection:
658643
"""
659644
Helper function that contains the setup needed for custom authorizers
@@ -687,7 +672,6 @@ def _with_custom_authorizer(auth_username=None,
687672
kwargs["password"] = auth_password
688673

689674
tls_ctx_options = awscrt.io.TlsContextOptions()
690-
tls_ctx_options.cipher_pref = cipher_pref
691675
if not use_websockets:
692676
kwargs["port"] = 443
693677
tls_ctx_options.alpn_list = ["mqtt"]

0 commit comments

Comments
 (0)