ssl: share pyopenssl context option handling

Author: dkropachev

cassandra/cluster.py

@@ -1350,7 +1350,7 @@ def __init__(self,
             # connections go through NLB proxies whose addresses won't match
             # server certificates.
             _check_hostname_enabled = False
-            if ssl_context is not None and ssl_context.check_hostname:
+            if ssl_context is not None and getattr(ssl_context, 'check_hostname', False):
                 _check_hostname_enabled = True
             if ssl_options is not None and ssl_options.get('check_hostname', False):
                 _check_hostname_enabled = True

cassandra/connection.py

@@ -154,6 +154,86 @@ def _ipaddress_match(pattern, host_ip):
         return False
 
 
+def _default_pyopenssl_ssl_method(ssl_module):
+    for method_name in ('TLS_CLIENT_METHOD', 'TLS_METHOD', 'TLSv1_2_METHOD'):
+        method = getattr(ssl_module, method_name, None)
+        if method is not None:
+            return method
+    raise ImportError('pyOpenSSL does not expose a secure TLS client method')
+
+
+def _pyopenssl_ssl_method_from_ssl_version(ssl_version, ssl_module):
+    if not isinstance(ssl_version, type(ssl.PROTOCOL_TLS)):
+        return ssl_version
+
+    protocol_method_names = (
+        ('PROTOCOL_TLS', None),
+        ('PROTOCOL_SSLv23', None),
+        ('PROTOCOL_TLS_CLIENT', None),
+        ('PROTOCOL_TLS_SERVER', ('TLS_SERVER_METHOD', 'TLS_METHOD')),
+        ('PROTOCOL_TLSv1', ('TLSv1_METHOD',)),
+        ('PROTOCOL_TLSv1_1', ('TLSv1_1_METHOD',)),
+        ('PROTOCOL_TLSv1_2', ('TLSv1_2_METHOD',)),
+    )
+    for protocol_name, method_names in protocol_method_names:
+        if getattr(ssl, protocol_name, None) is ssl_version:
+            if method_names is None:
+                return _default_pyopenssl_ssl_method(ssl_module)
+            for method_name in method_names:
+                method = getattr(ssl_module, method_name, None)
+                if method is not None:
+                    return method
+            raise ValueError('pyOpenSSL does not expose a method for {}'.format(protocol_name))
+
+    return ssl_version
+
+
+def _pyopenssl_verify_mode_from_cert_reqs(cert_reqs, ssl_module):
+    if not isinstance(cert_reqs, type(ssl.CERT_NONE)):
+        return cert_reqs
+    if cert_reqs == ssl.CERT_NONE:
+        return ssl_module.VERIFY_NONE
+    if cert_reqs in (ssl.CERT_OPTIONAL, ssl.CERT_REQUIRED):
+        return ssl_module.VERIFY_PEER
+    return cert_reqs
+
+
+def _build_pyopenssl_context_from_options(ssl_options, ssl_module):
+    ssl_version = (ssl_options['ssl_version']
+                   if 'ssl_version' in ssl_options else _default_pyopenssl_ssl_method(ssl_module))
+    ssl_version = _pyopenssl_ssl_method_from_ssl_version(ssl_version, ssl_module)
+    context = ssl_module.Context(ssl_version)
+    certfile = ssl_options.get('certfile', None)
+    keyfile = ssl_options.get('keyfile', None)
+    if certfile:
+        use_certificate_chain_file = getattr(context, 'use_certificate_chain_file', None)
+        if use_certificate_chain_file:
+            use_certificate_chain_file(certfile)
+        else:
+            context.use_certificate_file(certfile)
+        context.use_privatekey_file(keyfile or certfile)
+        context.check_privatekey()
+    elif keyfile:
+        context.use_privatekey_file(keyfile)
+    ca_certs = ssl_options.get('ca_certs', None)
+    if ca_certs:
+        context.load_verify_locations(ca_certs)
+    ciphers = ssl_options.get('ciphers', None)
+    if ciphers:
+        context.set_cipher_list(ciphers)
+    cert_reqs = ssl_options.get('cert_reqs', None)
+    if cert_reqs is None:
+        cert_reqs = (ssl_module.VERIFY_PEER
+                     if (ssl_options.get('ca_certs', None) or ssl_options.get('check_hostname', False))
+                     else ssl_module.VERIFY_NONE)
+    cert_reqs = _pyopenssl_verify_mode_from_cert_reqs(cert_reqs, ssl_module)
+    context.set_verify(
+        cert_reqs,
+        callback=lambda _connection, _x509, _errnum, _errdepth, ok: ok
+    )
+    return context
+
+
 segment_codec_no_compression = SegmentCodec()
 segment_codec_lz4 = None
 

cassandra/datastax/cloud/__init__.py

@@ -34,6 +34,7 @@
     from zipfile import BadZipfile as BadZipFile
 
 from cassandra import DriverException
+from cassandra.connection import _build_pyopenssl_context_from_options
 
 log = logging.getLogger(__name__)
 
@@ -89,7 +90,7 @@ def get_cloud_config(cloud_config, create_pyopenssl_context=False):
 
     config = read_metadata_info(config, cloud_config)
     if create_pyopenssl_context:
-        config.ssl_context = config.pyopenssl_context
+        config.ssl_context = getattr(config, 'pyopenssl_context', config.ssl_context)
     return config
 
 
@@ -112,19 +113,19 @@ def parse_cloud_config(path, cloud_config, create_pyopenssl_context):
 
     config = CloudConfig.from_dict(data)
     config_dir = os.path.dirname(path)
+    ca_cert_location = os.path.join(config_dir, 'ca.crt')
+    cert_location = os.path.join(config_dir, 'cert')
+    key_location = os.path.join(config_dir, 'key')
 
     if 'ssl_context' in cloud_config:
         config.ssl_context = cloud_config['ssl_context']
     else:
         # Load the ssl_context before we delete the temporary directory
-        ca_cert_location = os.path.join(config_dir, 'ca.crt')
-        cert_location = os.path.join(config_dir, 'cert')
-        key_location = os.path.join(config_dir, 'key')
         # Regardless of if we create a pyopenssl context, we still need the builtin one
         # to connect to the metadata service
         config.ssl_context = _ssl_context_from_cert(ca_cert_location, cert_location, key_location)
-        if create_pyopenssl_context:
-            config.pyopenssl_context = _pyopenssl_context_from_cert(ca_cert_location, cert_location, key_location)
+    if create_pyopenssl_context:
+        config.pyopenssl_context = _pyopenssl_context_from_cert(ca_cert_location, cert_location, key_location)
 
     return config
 
@@ -176,25 +177,19 @@ def _ssl_context_from_cert(ca_cert_location, cert_location, key_location):
     return ssl_context
 
 
-def _default_pyopenssl_ssl_method(ssl_module):
-    for method_name in ('TLS_CLIENT_METHOD', 'TLS_METHOD', 'TLSv1_2_METHOD'):
-        method = getattr(ssl_module, method_name, None)
-        if method is not None:
-            return method
-    raise ImportError('pyOpenSSL does not expose a secure TLS client method')
-
-
 def _pyopenssl_context_from_cert(ca_cert_location, cert_location, key_location):
     try:
         from OpenSSL import SSL
     except ImportError as e:
         raise ImportError(
             "PyOpenSSL must be installed to connect to Astra with the Eventlet or Twisted event loops")\
             .with_traceback(e.__traceback__)
-    ssl_context = SSL.Context(_default_pyopenssl_ssl_method(SSL))
-    ssl_context.set_verify(SSL.VERIFY_PEER, callback=lambda _1, _2, _3, _4, ok: ok)
-    ssl_context.use_certificate_file(cert_location)
-    ssl_context.use_privatekey_file(key_location)
-    ssl_context.load_verify_locations(ca_cert_location)
-
-    return ssl_context
+    return _build_pyopenssl_context_from_options(
+        {
+            'ca_certs': ca_cert_location,
+            'certfile': cert_location,
+            'keyfile': key_location,
+            'cert_reqs': SSL.VERIFY_PEER,
+        },
+        SSL
+    )

cassandra/io/eventletreactor.py

@@ -24,6 +24,7 @@
 import time
 
 from cassandra.connection import (Connection, ConnectionShutdown, Timer, TimerManager,
+                                  _build_pyopenssl_context_from_options,
                                   _validate_pyopenssl_hostname)
 try:
     from eventlet.green.OpenSSL import SSL
@@ -36,14 +37,6 @@
 log = logging.getLogger(__name__)
 
 
-def _default_ssl_method():
-    for method_name in ('TLS_CLIENT_METHOD', 'TLS_METHOD', 'TLSv1_2_METHOD'):
-        method = getattr(SSL, method_name, None)
-        if method is not None:
-            return method
-    raise ImportError('pyOpenSSL does not expose a secure TLS client method')
-
-
 def _check_pyopenssl():
     if not _PYOPENSSL:
         raise ImportError(
@@ -52,28 +45,6 @@ def _check_pyopenssl():
         )
 
 
-def _build_pyopenssl_context_from_options(ssl_options):
-    ssl_version = (ssl_options['ssl_version']
-                   if 'ssl_version' in ssl_options else _default_ssl_method())
-    context = SSL.Context(ssl_version)
-    if 'certfile' in ssl_options:
-        context.use_certificate_file(ssl_options['certfile'])
-    if 'keyfile' in ssl_options:
-        context.use_privatekey_file(ssl_options['keyfile'])
-    if 'ca_certs' in ssl_options:
-        context.load_verify_locations(ssl_options['ca_certs'])
-    cert_reqs = ssl_options.get('cert_reqs', None)
-    if cert_reqs is None:
-        cert_reqs = (SSL.VERIFY_PEER
-                     if (ssl_options.get('ca_certs', None) or ssl_options.get('check_hostname', False))
-                     else SSL.VERIFY_NONE)
-    context.set_verify(
-        cert_reqs,
-        callback=lambda _connection, _x509, _errnum, _errdepth, ok: ok
-    )
-    return context
-
-
 class EventletConnection(Connection):
     """
     An implementation of :class:`.Connection` that utilizes ``eventlet``.
@@ -158,7 +129,7 @@ def _validate_hostname(self):
 
     def _build_ssl_context_from_options(self):
         _check_pyopenssl()
-        return _build_pyopenssl_context_from_options(self.ssl_options)
+        return _build_pyopenssl_context_from_options(self.ssl_options, SSL)
 
     def close(self):
         with self.lock:

cassandra/io/twistedreactor.py

@@ -29,6 +29,7 @@
 from zope.interface import implementer
 
 from cassandra.connection import (Connection, ConnectionShutdown, Timer, TimerManager, ConnectionException,
+                                  _build_pyopenssl_context_from_options,
                                   _validate_pyopenssl_hostname)
 
 try:
@@ -40,14 +41,6 @@
 log = logging.getLogger(__name__)
 
 
-def _default_ssl_method():
-    for method_name in ("TLS_CLIENT_METHOD", "TLS_METHOD", "TLSv1_2_METHOD"):
-        method = getattr(SSL, method_name, None)
-        if method is not None:
-            return method
-    raise ImportError("pyOpenSSL does not expose a secure TLS client method")
-
-
 def _check_pyopenssl():
     if not _HAS_SSL:
         raise ImportError(
@@ -56,28 +49,6 @@ def _check_pyopenssl():
         )
 
 
-def _build_pyopenssl_context_from_options(ssl_options):
-    ssl_version = (ssl_options["ssl_version"]
-                   if "ssl_version" in ssl_options else _default_ssl_method())
-    context = SSL.Context(ssl_version)
-    if "certfile" in ssl_options:
-        context.use_certificate_file(ssl_options["certfile"])
-    if "keyfile" in ssl_options:
-        context.use_privatekey_file(ssl_options["keyfile"])
-    if "ca_certs" in ssl_options:
-        context.load_verify_locations(ssl_options["ca_certs"])
-    cert_reqs = ssl_options.get("cert_reqs", None)
-    if cert_reqs is None:
-        cert_reqs = (SSL.VERIFY_PEER
-                     if (ssl_options.get("ca_certs", None) or ssl_options.get("check_hostname", False))
-                     else SSL.VERIFY_NONE)
-    context.set_verify(
-        cert_reqs,
-        callback=lambda _connection, _x509, _errnum, _errdepth, ok: ok
-    )
-    return context
-
-
 def _cleanup(cleanup_weakref):
     try:
         cleanup_weakref()._cleanup()
@@ -187,8 +158,7 @@ def __init__(self, endpoint, ssl_context, ssl_options, check_hostname, timeout):
         if ssl_context is not None:
             self.context = ssl_context
         else:
-            self.context = _build_pyopenssl_context_from_options(self.ssl_options)
-        self.context.set_info_callback(self.info_callback)
+            self.context = _build_pyopenssl_context_from_options(self.ssl_options, SSL)
 
     def verify_callback(self, connection, x509, errnum, errdepth, ok):
         return ok
@@ -208,6 +178,8 @@ def info_callback(self, connection, where, ret):
     def clientConnectionForTLS(self, tlsProtocol):
         connection = SSL.Connection(self.context, None)
         connection.set_app_data(tlsProtocol)
+        if self.check_hostname:
+            connection.set_info_callback(self.info_callback)
         if self.ssl_options and "server_hostname" in self.ssl_options:
             connection.set_tlsext_host_name(self.ssl_options['server_hostname'].encode('ascii'))
         return connection
@@ -256,7 +228,7 @@ def _check_pyopenssl(self):
 
     def _build_ssl_context_from_options(self):
         _check_pyopenssl()
-        return _build_pyopenssl_context_from_options(self.ssl_options)
+        return _build_pyopenssl_context_from_options(self.ssl_options, SSL)
 
     def add_connection(self):
         """

tests/unit/io/test_eventletreactor.py

@@ -41,7 +41,7 @@
     eventletreactor = None
     EventletConnection = None  # noqa
 
-from cassandra.connection import Connection, DefaultEndPoint
+from cassandra.connection import Connection, DefaultEndPoint, _default_pyopenssl_ssl_method
 
 CA_CERTS = os.path.abspath(os.path.join(
     os.path.dirname(__file__), '..', '..', 'integration', 'long', 'ssl', 'rootCa.crt'))
@@ -82,7 +82,7 @@ def test_empty_ssl_options_build_pyopenssl_context(self):
 
     def test_empty_ssl_options_default_to_negotiating_tls(self):
         with patch.object(eventletreactor.SSL, 'Context') as context_mock:
-            context = eventletreactor._build_pyopenssl_context_from_options({})
+            context = eventletreactor._build_pyopenssl_context_from_options({}, eventletreactor.SSL)
 
         context_mock.assert_called_once_with(eventletreactor.SSL.TLS_CLIENT_METHOD)
         assert context is context_mock.return_value
@@ -91,21 +91,28 @@ def test_default_ssl_method_falls_back_to_tls_method(self):
         tls_method = object()
 
         with patch.object(eventletreactor, 'SSL', SimpleNamespace(TLS_METHOD=tls_method)):
-            assert eventletreactor._default_ssl_method() is tls_method
+            assert _default_pyopenssl_ssl_method(eventletreactor.SSL) is tls_method
 
     def test_default_ssl_method_falls_back_to_tlsv1_2_method(self):
         tlsv1_2_method = object()
 
         with patch.object(eventletreactor, 'SSL', SimpleNamespace(TLSv1_2_METHOD=tlsv1_2_method)):
-            assert eventletreactor._default_ssl_method() is tlsv1_2_method
+            assert _default_pyopenssl_ssl_method(eventletreactor.SSL) is tlsv1_2_method
 
     def test_ssl_version_option_is_preserved(self):
         with patch.object(eventletreactor.SSL, 'Context') as context_mock:
             eventletreactor._build_pyopenssl_context_from_options(
-                {'ssl_version': eventletreactor.SSL.TLSv1_2_METHOD})
+                {'ssl_version': eventletreactor.SSL.TLSv1_2_METHOD}, eventletreactor.SSL)
 
         context_mock.assert_called_once_with(eventletreactor.SSL.TLSv1_2_METHOD)
 
+    def test_stdlib_ssl_version_option_is_translated(self):
+        with patch.object(eventletreactor.SSL, 'Context') as context_mock:
+            eventletreactor._build_pyopenssl_context_from_options(
+                {'ssl_version': ssl.PROTOCOL_TLS}, eventletreactor.SSL)
+
+        context_mock.assert_called_once_with(eventletreactor.SSL.TLS_CLIENT_METHOD)
+
     def test_ca_certs_default_to_required_validation(self):
         conn = EventletConnection.__new__(EventletConnection)