TlsLite: tlslite_cherry.py

"""HTTPS servers for CherryPy using the TLS Lite package."""


# A shameless rip of an eerily similar module that used M2Crypto
# to do the same thing.  Kudos to Tim Evans for all that; his module
# didn't work for me, so I did this instead.

# I have only the very vaguest notion what I am doing here.  Ergo,
# this code is appropriate for only a ridiculously basic CherryPy
# SSL server setup.  It works for me.  Your mileage may vary.

# Daniel McNair


from tlslite.api import *
from cherrypy import cpg, _cphttpserver, _cputil


class SslCherryConnection(TLSConnection):
    def __init__(self, socket):
        """Create a TLSConnection using the key file specified in the config"""

        TLSConnection.__init__(self, socket)

        self.__socket = socket

        s = open(cpg.configOption.sslCertificateFile).read()
        x509 = X509()
        x509.parse(s)
        self.certChain = X509CertChain([x509])
        s = open(cpg.configOption.sslKeyFile).read()
        self.privateKey = parsePEMKey(s, private=True)
        self.sessionCache = SessionCache()

        self._cpLogMessage = _cputil.getSpecialFunction('_cpLogMessage')

    # forward these things to my socket object
    def bind(self, *args):
        return self.__socket.bind(*args)
    def listen(self, *args):
        return self.__socket.listen(*args)
    def setblocking(self, *args):
        return self.__socket.setblocking(*args)

    def accept(self):
        """Accept a connection and perform SSL/TLS handshaking on it."""

        # dm- it seems to me that this whole while 1: thingee here
        # is intended just to turn this accept() call on a non-blocking
        # socket into a blocking method.  Any ideas why?

        while 1:
            try:
                # get the raw socket
                sock, addr = self.__socket.accept()

                # now wrap that
                conn = SslCherryConnection(sock)

                # do handshaking
                conn.handshakeServer(certChain=self.certChain,
                                     privateKey=self.privateKey,
                                     reqCert=False,
                                     sessionCache=self.sessionCache)

                # give back the new connection object
                return conn, addr
            except TLSRemoteAlert, alert:
                self._cpLogMessage('Remote alert "%s"' % alert.description,
                                   'TLS', 1)

# dm- believe it or not I didn't change anything below this line

class SslCherryServer(_cphttpserver.CherryHTTPServer):
    """Single threaded HTTPS server"""

    def server_bind(self):
        """Wrap the socket with a SslCherryConnection object before proceeding as normal"""

        self.socket = SslCherryConnection(self.socket)
        _cphttpserver.CherryHTTPServer.server_bind(self)


class SslCherryPooledThreadServer(_cphttpserver.PooledThreadServer):
    """Thread pooled HTTPS server"""

    def server_bind(self):
        """Wrap the socket with a SslCherryConnection object before proceeding as normal"""

        self.socket = SslCherryConnection(self.socket)
        _cphttpserver.PooledThreadServer.server_bind(self)


def start(configFile=None, parsedConfigFile=None, configDict={}):
    """Start an HTTPS server instead of an HTTP server"""

    # Initialise config
    cpg.server.start(configFile, parsedConfigFile, configDict, True)

    # Choose server class
    if cpg.configOption.threadPool > 1:
        MyCherryHTTPServer = SslCherryPooledThreadServer
    else:
        MyCherryHTTPServer = SslCherryServer

    # Below is similar to _cphttpserver.start
    if (cpg.configOption.threadPool > 1) and \
            cpg.configOption.sessionStorageType == 'file':
        cpg._sessionFileLock = threading.RLock()

    MyCherryHTTPServer.request_queue_size = cpg.configOption.socketQueueSize

    _cphttpserver.CherryHTTPRequestHandler.protocol_version = cpg.configOption.protocolVersion

    _cphttpserver.run_server(_cphttpserver.CherryHTTPRequestHandler, MyCherryHTTPServer,
                             (cpg.configOption.socketHost, cpg.configOption.socketPort),
                             cpg.configOption.socketFile)