forked from HelloZeroNet/ZeroNet
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Version 0.3.1, rev238, Connection encryption using TLS, One click sit…
…e clone feature, Encryption stats, Disable encryption startup parameter, Disable ssl compression startup parameter, Exchange supported encryption methods at handshake, Alternative open port checker, Option to store site privatekey in users.json, Torrent tracker swap, Test for bip32 based site creation, cloning and sslcert creation, Fix for Chrome plugin on OSX, Separate siteSign websocket command, Update pybitcointools to major speedup, Re-add sslwrap for python 0.2.9+, Disable SSL compression to save memory and better performance
- Loading branch information
1 parent
f0597af
commit a78907c
Showing
64 changed files
with
4,132 additions
and
204 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,101 @@ | ||
| import sys, logging, os | ||
| from Config import config | ||
| import gevent | ||
| from util import SslPatch | ||
|
|
||
| class CryptConnectionManager: | ||
| def __init__(self): | ||
| # OpenSSL params | ||
| if sys.platform.startswith("win"): | ||
| self.openssl_bin = "src\\lib\\opensslVerify\\openssl.exe" | ||
| else: | ||
| self.openssl_bin = "openssl" | ||
| self.openssl_env = {"OPENSSL_CONF": "src/lib/opensslVerify/openssl.cnf"} | ||
|
|
||
| self.crypt_supported = [] # Supported cryptos | ||
|
|
||
|
|
||
| # Select crypt that supported by both sides | ||
| # Return: Name of the crypto | ||
| def selectCrypt(self, client_supported): | ||
| for crypt in self.crypt_supported: | ||
| if crypt in client_supported: | ||
| return crypt | ||
| return False | ||
|
|
||
|
|
||
| # Wrap socket for crypt | ||
| # Return: wrapped socket | ||
| def wrapSocket(self, sock, crypt, server=False): | ||
| if crypt == "tls-rsa": | ||
| ciphers = "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:AES128-GCM-SHA256:AES128-SHA256:HIGH:!aNULL:!eNULL:!EXPORT:!DSS:!DES:!RC4:!3DES:!MD5:!PSK" | ||
| if server: | ||
| return gevent.ssl.wrap_socket(sock, server_side=server, keyfile='%s/key-rsa.pem' % config.data_dir, certfile='%s/cert-rsa.pem' % config.data_dir, ciphers=ciphers) | ||
| else: | ||
| return gevent.ssl.wrap_socket(sock, ciphers=ciphers) | ||
| else: | ||
| return sock | ||
|
|
||
|
|
||
| def removeCerts(self): | ||
| for file_name in ["cert-rsa.pem", "key-rsa.pem"]: | ||
| file_path = "%s/%s" % (config.data_dir, file_name) | ||
| if os.path.isfile(file_path): os.unlink(file_path) | ||
|
|
||
|
|
||
| # Loand and create cert files is necessary | ||
| def loadCerts(self): | ||
| if config.disable_encryption: return False | ||
|
|
||
| if self.loadSslRsaCert(): | ||
| self.crypt_supported.append("tls-rsa") | ||
|
|
||
|
|
||
| # Try to create RSA server cert + sign for connection encryption | ||
| # Return: True on success | ||
| def loadSslRsaCert(self): | ||
| import subprocess | ||
|
|
||
| if os.path.isfile("%s/cert-rsa.pem" % config.data_dir) and os.path.isfile("%s/key-rsa.pem" % config.data_dir): | ||
| return True # Files already exits | ||
|
|
||
| back = subprocess.Popen( | ||
| "%s req -x509 -newkey rsa:2048 -sha256 -batch -keyout %s/key-rsa.pem -out %s/cert-rsa.pem -nodes -config %s" % (self.openssl_bin, config.data_dir, config.data_dir, self.openssl_env["OPENSSL_CONF"]), | ||
| shell=True, stderr=subprocess.STDOUT, stdout=subprocess.PIPE, env=self.openssl_env | ||
| ).stdout.read().strip() | ||
| logging.debug("Generating RSA cert and key PEM files...%s" % back) | ||
|
|
||
| if os.path.isfile("%s/cert-rsa.pem" % config.data_dir) and os.path.isfile("%s/key-rsa.pem" % config.data_dir): | ||
| return True | ||
| else: | ||
| logging.error("RSA ECC SSL cert generation failed, cert or key files not exits.") | ||
| return False | ||
|
|
||
|
|
||
| # Not used yet: Missing on some platform | ||
| def createSslEccCert(self): | ||
| return False | ||
| import subprocess | ||
|
|
||
| # Create ECC privatekey | ||
| back = subprocess.Popen( | ||
| "%s ecparam -name prime256v1 -genkey -out %s/key-ecc.pem" % (self.openssl_bin, config.data_dir), | ||
| shell=True, stderr=subprocess.STDOUT, stdout=subprocess.PIPE, env=self.openssl_env | ||
| ).stdout.read().strip() | ||
| self.log.debug("Generating ECC privatekey PEM file...%s" % back) | ||
|
|
||
| # Create ECC cert | ||
| back = subprocess.Popen( | ||
| "%s req -new -key %s/key-ecc.pem -x509 -nodes -out %s/cert-ecc.pem -config %s" % (self.openssl_bin, config.data_dir, config.data_dir, self.openssl_env["OPENSSL_CONF"]), | ||
| shell=True, stderr=subprocess.STDOUT, stdout=subprocess.PIPE, env=self.openssl_env | ||
| ).stdout.read().strip() | ||
| self.log.debug("Generating ECC cert PEM file...%s" % back) | ||
|
|
||
| if os.path.isfile("%s/cert-ecc.pem" % config.data_dir) and os.path.isfile("%s/key-ecc.pem" % config.data_dir): | ||
| return True | ||
| else: | ||
| self.logging.error("ECC SSL cert generation failed, cert or key files not exits.") | ||
| return False | ||
|
|
||
|
|
||
| manager = CryptConnectionManager() |
Oops, something went wrong.