Skip to content

[python/tornado] ssl improvements #7061

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
wing328 merged 1 commit into from
Nov 28, 2017
Merged

[python/tornado] ssl improvements #7061

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 6 additions & 26 deletions modules/swagger-codegen/src/main/resources/python/tornado/rest.mustache
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,9 +6,7 @@ import io
import json
import logging
import re
import ssl

import certifi
# python 2 and python 3 compatibility library
import six
from six.moves.urllib.parse import urlencode
Expand Down Expand Up @@ -41,30 +39,10 @@ class RESTClientObject(object):

def __init__(self, configuration, pools_size=4, maxsize=4):
# maxsize is number of requests to host that are allowed in parallel
# ca_certs vs cert_file vs key_file
# http://stackoverflow.com/a/23957365/2985775

# ca_certs
if configuration.ssl_ca_cert:
ca_certs = configuration.ssl_ca_cert
else:
# if not set certificate file, use Mozilla's root certificates.
ca_certs = certifi.where()
Copy link
Contributor

@wing328 wing328 Nov 27, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@tomplus shall we keep the default certificate certifi.where()?

Copy link
Contributor

@kenjones-cisco kenjones-cisco Nov 27, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is also handled by the tornado client it seems based on the link provided.

Copy link
Contributor Author

@tomplus tomplus Nov 27, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Latest versions of Tornado use certifi. But it's worth to mention that unstable version from master doesn't have this dependency, certificates from system will be used. A developer will still be able to add certifiy if she/he really needs to do it.


if hasattr(ssl, 'create_default_context'):
# require Python 2.7.9+, 3.4+
self.ssl_context = ssl.create_default_context()
Copy link
Contributor

@kenjones-cisco kenjones-cisco Nov 27, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does the actual tornado client handle creating the ssl_context now, thereby making this redundant?

Copy link
Contributor Author

@tomplus tomplus Nov 27, 2017 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, Tornado creates context: https://github.com/tornadoweb/tornado/blob/v4.5.2/tornado/simple_httpclient.py#L248

self.ssl_context.load_verify_locations(cafile=ca_certs)
if configuration.cert_file:
self.ssl_context.load_cert_chain(
configuration.cert_file, keyfile=configuration.key_file
)

elif configuration.cert_file or configuration.ssl_ca_cert:
raise NotImplementedError('SSL requires Python 2.7.9+, 3.4+')

else:
self.ssl_context = None
self.ca_certs = configuration.ssl_ca_cert
self.client_key = configuration.key_file
self.client_cert = configuration.cert_file

self.proxy_port = self.proxy_host = None

Expand Down Expand Up @@ -106,7 +84,9 @@ class RESTClientObject(object):
)

request = httpclient.HTTPRequest(url)
request.ssl_context = self.ssl_context
request.ca_certs = self.ca_certs
request.client_key = self.client_key
request.client_cert = self.client_cert
request.proxy_host = self.proxy_host
request.proxy_port = self.proxy_port
request.method = method
Expand Down
32 changes: 6 additions & 26 deletions samples/client/petstore/python-tornado/petstore_api/rest.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,9 +15,7 @@
import json
import logging
import re
import ssl

import certifi
# python 2 and python 3 compatibility library
import six
from six.moves.urllib.parse import urlencode
Expand Down Expand Up @@ -50,30 +48,10 @@ class RESTClientObject(object):

def __init__(self, configuration, pools_size=4, maxsize=4):
# maxsize is number of requests to host that are allowed in parallel
# ca_certs vs cert_file vs key_file
# http://stackoverflow.com/a/23957365/2985775

# ca_certs
if configuration.ssl_ca_cert:
ca_certs = configuration.ssl_ca_cert
else:
# if not set certificate file, use Mozilla's root certificates.
ca_certs = certifi.where()

if hasattr(ssl, 'create_default_context'):
# require Python 2.7.9+, 3.4+
self.ssl_context = ssl.create_default_context()
self.ssl_context.load_verify_locations(cafile=ca_certs)
if configuration.cert_file:
self.ssl_context.load_cert_chain(
configuration.cert_file, keyfile=configuration.key_file
)

elif configuration.cert_file or configuration.ssl_ca_cert:
raise NotImplementedError('SSL requires Python 2.7.9+, 3.4+')

else:
self.ssl_context = None
self.ca_certs = configuration.ssl_ca_cert
self.client_key = configuration.key_file
self.client_cert = configuration.cert_file

self.proxy_port = self.proxy_host = None

Expand Down Expand Up @@ -115,7 +93,9 @@ def request(self, method, url, query_params=None, headers=None, body=None,
)

request = httpclient.HTTPRequest(url)
request.ssl_context = self.ssl_context
request.ca_certs = self.ca_certs
request.client_key = self.client_key
request.client_cert = self.client_cert
request.proxy_host = self.proxy_host
request.proxy_port = self.proxy_port
request.method = method
Expand Down