OLD | NEW |
1 # Copyright (c) 2014 The Chromium Authors. All rights reserved. | 1 # Copyright (c) 2014 The Chromium Authors. All rights reserved. |
2 # Use of this source code is governed by a BSD-style license that can be | 2 # Use of this source code is governed by a BSD-style license that can be |
3 # found in the LICENSE file. | 3 # found in the LICENSE file. |
| 4 |
4 """ | 5 """ |
5 Provides a utility function for https connections with certificate verification. | 6 A http client with support for https connections with certificate verification. |
6 | 7 |
7 The verification is based on http://tools.ietf.org/html/rfc6125#section-6.4.3 | 8 The verification is based on http://tools.ietf.org/html/rfc6125#section-6.4.3 |
8 and the code is from Lib/ssl.py in python3: | 9 and the code is from Lib/ssl.py in python3: |
9 http://hg.python.org/cpython/file/4dac45f88d45/Lib/ssl.py | 10 http://hg.python.org/cpython/file/4dac45f88d45/Lib/ssl.py |
10 | 11 |
11 One use case is to download Chromium DEPS file in a secure way: | 12 One use case is to download Chromium DEPS file in a secure way: |
12 https://src.chromium.org/chrome/trunk/src/DEPS | 13 https://src.chromium.org/chrome/trunk/src/DEPS |
13 | 14 |
14 Notice: python 2.7 or newer is required. | 15 Notice: python 2.7 or newer is required. |
15 """ | 16 """ |
16 | 17 |
| 18 import cookielib |
17 import httplib | 19 import httplib |
18 import os | 20 import os |
19 import re | 21 import re |
20 import socket | 22 import socket |
21 import ssl | 23 import ssl |
| 24 import urllib |
22 import urllib2 | 25 import urllib2 |
23 | 26 |
| 27 import http_client |
| 28 |
24 | 29 |
25 _SCRIPT_DIR = os.path.dirname(__file__) | 30 _SCRIPT_DIR = os.path.dirname(__file__) |
26 _TRUSTED_ROOT_CERTS = os.path.join(_SCRIPT_DIR, 'cacert.pem') | 31 _TRUSTED_ROOT_CERTS = os.path.join(_SCRIPT_DIR, 'cacert.pem') |
27 | 32 |
28 | 33 |
29 class CertificateError(ValueError): | 34 class CertificateError(ValueError): |
30 pass | 35 pass |
31 | 36 |
32 | 37 |
33 def _DNSNameMatch(dn, hostname, max_wildcards=1): | 38 def _DNSNameMatch(dn, hostname, max_wildcards=1): |
(...skipping 130 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
164 # Pass a reference to the function below so that verification against | 169 # Pass a reference to the function below so that verification against |
165 # trusted root certs could be injected. | 170 # trusted root certs could be injected. |
166 return self.do_open(self.GetConnection, req) | 171 return self.do_open(self.GetConnection, req) |
167 | 172 |
168 def GetConnection(self, host, **kwargs): | 173 def GetConnection(self, host, **kwargs): |
169 params = dict(root_certs=self.root_certs) | 174 params = dict(root_certs=self.root_certs) |
170 params.update(kwargs) | 175 params.update(kwargs) |
171 return HTTPSConnection(host, **params) | 176 return HTTPSConnection(host, **params) |
172 | 177 |
173 | 178 |
174 def SendRequest(https_url): | 179 def _SendRequest(url, timeout=None): |
175 """Send request to the given https url, and return the server response. | 180 """Send request to the given https url, and return the server response. |
176 | 181 |
177 Args: | 182 Args: |
178 https_url: The https url to send request to. | 183 url: The https url to send request to. |
179 | 184 |
180 Returns: | 185 Returns: |
181 A string that is the response from the server. | 186 An integer: http code of the response. |
| 187 A string: content of the response. |
182 | 188 |
183 Raises: | 189 Raises: |
184 ValueError: Unexpected value is received during certificate verification. | |
185 CertificateError: Certificate verification fails. | 190 CertificateError: Certificate verification fails. |
186 """ | 191 """ |
187 if not https_url or not https_url.startswith('https://'): | 192 if not url: |
188 raise ValueError('Not a https request for url %s.' % str(https_url)) | 193 return None, None |
189 | 194 |
190 url_opener = urllib2.build_opener(HTTPSHandler) | 195 handlers = [] |
191 return url_opener.open(https_url).read() | 196 if url.startswith('https://'): |
| 197 # HTTPSHandler has to go first, because we don't want to send secure cookies |
| 198 # to a man in the middle. |
| 199 handlers.append(HTTPSHandler()) |
192 | 200 |
193 | 201 |
194 if __name__ == '__main__': | 202 cookie_file = os.environ.get('COOKIE_FILE') |
195 print SendRequest('https://src.chromium.org/chrome/trunk/src/DEPS') | 203 if cookie_file and os.path.exists(cookie_file): |
| 204 handlers.append( |
| 205 urllib2.HTTPCookieProcessor(cookielib.MozillaCookieJar(cookie_file))) |
| 206 |
| 207 url_opener = urllib2.build_opener(*handlers) |
| 208 if timeout is not None: |
| 209 response = url_opener.open(url, timeout=timeout) |
| 210 else: |
| 211 response = url_opener.open(url) |
| 212 return response.code, response.read() |
| 213 |
| 214 |
| 215 class HttpClientLocal(http_client.HttpClient): |
| 216 """This http client is used locally in a workstation, GCE VMs, etc.""" |
| 217 |
| 218 @staticmethod |
| 219 def Get(url, params={}, timeout=None): |
| 220 if params: |
| 221 url = '%s?%s' % (url, urllib.urlencode(params)) |
| 222 return _SendRequest(url, timeout=timeout) |
OLD | NEW |