chore: rename project coven → hack-house ⛧
Rebrand the Rust client crate (coven/ → hh/, package+binary "hack-house"), README, CLI strings, and branch (coven → hack-house). Gitea repo renamed cmd-chat → hack-house to match. Crypto/server logic unchanged; selftest + golden-vector test still green, binary is now `hack-house`. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
leetcrypt
@@ -0,0 +1,6 @@
|
||||
from .constants import Stage
|
||||
from .http1 import Http
|
||||
from .http3 import Http3
|
||||
|
||||
|
||||
__all__ = ("Http", "Stage", "Http3")
|
||||
@@ -0,0 +1,30 @@
|
||||
from enum import Enum, IntEnum
|
||||
|
||||
|
||||
class Stage(Enum):
|
||||
"""Enum for representing the stage of the request/response cycle
|
||||
|
||||
| ``IDLE`` Waiting for request
|
||||
| ``REQUEST`` Request headers being received
|
||||
| ``HANDLER`` Headers done, handler running
|
||||
| ``RESPONSE`` Response headers sent, body in progress
|
||||
| ``FAILED`` Unrecoverable state (error while sending response)
|
||||
|
|
||||
"""
|
||||
|
||||
IDLE = 0 # Waiting for request
|
||||
REQUEST = 1 # Request headers being received
|
||||
HANDLER = 3 # Headers done, handler running
|
||||
RESPONSE = 4 # Response headers sent, body in progress
|
||||
FAILED = 100 # Unrecoverable state (error while sending response)
|
||||
|
||||
|
||||
class HTTP(IntEnum):
|
||||
"""Enum for representing HTTP versions"""
|
||||
|
||||
VERSION_1 = 1
|
||||
VERSION_3 = 3
|
||||
|
||||
def display(self) -> str:
|
||||
value = 1.1 if self.value == 1 else self.value
|
||||
return f"HTTP/{value}"
|
||||
@@ -0,0 +1,619 @@
|
||||
from __future__ import annotations
|
||||
|
||||
from typing import TYPE_CHECKING
|
||||
|
||||
|
||||
if TYPE_CHECKING:
|
||||
from sanic.request import Request
|
||||
from sanic.response import BaseHTTPResponse
|
||||
|
||||
from asyncio import CancelledError, sleep
|
||||
from time import perf_counter
|
||||
|
||||
from sanic.compat import Header
|
||||
from sanic.exceptions import (
|
||||
BadRequest,
|
||||
ExpectationFailed,
|
||||
PayloadTooLarge,
|
||||
RequestCancelled,
|
||||
ServerError,
|
||||
ServiceUnavailable,
|
||||
)
|
||||
from sanic.headers import format_http1_response
|
||||
from sanic.helpers import has_message_body
|
||||
from sanic.http.constants import Stage
|
||||
from sanic.http.stream import Stream
|
||||
from sanic.log import access_logger, error_logger, logger
|
||||
from sanic.touchup import TouchUpMeta
|
||||
|
||||
|
||||
HTTP_CONTINUE = b"HTTP/1.1 100 Continue\r\n\r\n"
|
||||
|
||||
|
||||
class Http(Stream, metaclass=TouchUpMeta):
|
||||
""" "Internal helper for managing the HTTP/1.1 request/response cycle.
|
||||
|
||||
Raises:
|
||||
BadRequest: If the request body is malformed.
|
||||
Exception: If the request is malformed.
|
||||
ExpectationFailed: If the request is malformed.
|
||||
PayloadTooLarge: If the request body exceeds the size limit.
|
||||
RuntimeError: If the response status is invalid.
|
||||
ServerError: If the handler does not produce a response.
|
||||
ServerError: If the response is bigger than the content-length.
|
||||
"""
|
||||
|
||||
HEADER_CEILING = 16_384
|
||||
HEADER_MAX_SIZE = 0
|
||||
__touchup__ = (
|
||||
"http1_request_header",
|
||||
"http1_response_header",
|
||||
"read",
|
||||
)
|
||||
__slots__ = [
|
||||
"_send",
|
||||
"_receive_more",
|
||||
"dispatch",
|
||||
"recv_buffer",
|
||||
"protocol",
|
||||
"expecting_continue",
|
||||
"stage",
|
||||
"keep_alive",
|
||||
"head_only",
|
||||
"request",
|
||||
"exception",
|
||||
"url",
|
||||
"request_body",
|
||||
"request_bytes",
|
||||
"request_bytes_left",
|
||||
"response",
|
||||
"response_func",
|
||||
"response_size",
|
||||
"response_bytes_left",
|
||||
"upgrade_websocket",
|
||||
"perft0",
|
||||
]
|
||||
|
||||
def __init__(self, protocol):
|
||||
self._send = protocol.send
|
||||
self._receive_more = protocol.receive_more
|
||||
self.recv_buffer = protocol.recv_buffer
|
||||
self.protocol = protocol
|
||||
self.keep_alive = True
|
||||
self.stage: Stage = Stage.IDLE
|
||||
self.dispatch = self.protocol.app.dispatch
|
||||
|
||||
def init_for_request(self):
|
||||
"""Init/reset all per-request variables."""
|
||||
self.exception = None
|
||||
self.expecting_continue: bool = False
|
||||
self.head_only = None
|
||||
self.request_body = None
|
||||
self.request_bytes = None
|
||||
self.request_bytes_left = None
|
||||
self.request_max_size = self.protocol.request_max_size
|
||||
self.request: Request = None
|
||||
self.response: BaseHTTPResponse = None
|
||||
self.upgrade_websocket = False
|
||||
self.url = None
|
||||
self.perft0 = None
|
||||
|
||||
def __bool__(self):
|
||||
"""Test if request handling is in progress"""
|
||||
return self.stage in (Stage.HANDLER, Stage.RESPONSE)
|
||||
|
||||
async def http1(self):
|
||||
"""HTTP 1.1 connection handler"""
|
||||
# Handle requests while the connection stays reusable
|
||||
while self.keep_alive and self.stage is Stage.IDLE:
|
||||
self.init_for_request()
|
||||
# Wait for incoming bytes (in IDLE stage)
|
||||
if not self.recv_buffer:
|
||||
await self._receive_more()
|
||||
self.stage = Stage.REQUEST
|
||||
try:
|
||||
# Receive and handle a request
|
||||
self.response_func = self.http1_response_header
|
||||
|
||||
await self.http1_request_header()
|
||||
|
||||
self.stage = Stage.HANDLER
|
||||
self.perft0 = perf_counter()
|
||||
self.request.conn_info = self.protocol.conn_info
|
||||
await self.protocol.request_handler(self.request)
|
||||
|
||||
# Handler finished, response should've been sent
|
||||
if self.stage is Stage.HANDLER and not self.upgrade_websocket:
|
||||
raise ServerError("Handler produced no response")
|
||||
|
||||
if self.stage is Stage.RESPONSE:
|
||||
await self.response.send(end_stream=True)
|
||||
except CancelledError as exc:
|
||||
# Write an appropriate response before exiting
|
||||
if not self.protocol.transport:
|
||||
logger.info(
|
||||
f"Request: {self.request.method} {self.request.url} "
|
||||
"stopped. Transport is closed."
|
||||
)
|
||||
return
|
||||
e = (
|
||||
RequestCancelled()
|
||||
if self.protocol.conn_info.lost
|
||||
else (self.exception or exc)
|
||||
)
|
||||
self.exception = None
|
||||
self.keep_alive = False
|
||||
await self.error_response(e)
|
||||
except Exception as e:
|
||||
# Write an error response
|
||||
await self.error_response(e)
|
||||
|
||||
# Try to consume any remaining request body
|
||||
if self.request_body:
|
||||
if self.response and 200 <= self.response.status < 300:
|
||||
error_logger.error(f"{self.request} body not consumed.")
|
||||
# Limit the size because the handler may have set it infinite
|
||||
self.request_max_size = min(
|
||||
self.request_max_size, self.protocol.request_max_size
|
||||
)
|
||||
try:
|
||||
async for _ in self:
|
||||
pass
|
||||
except PayloadTooLarge:
|
||||
# We won't read the body and that may cause httpx and
|
||||
# tests to fail. This little delay allows clients to push
|
||||
# a small request into network buffers before we close the
|
||||
# socket, so that they are then able to read the response.
|
||||
await sleep(0.001)
|
||||
self.keep_alive = False
|
||||
|
||||
# Clean up to free memory and for the next request
|
||||
if self.request:
|
||||
self.request.stream = None
|
||||
if self.response:
|
||||
self.response.stream = None
|
||||
|
||||
async def http1_request_header(self): # no cov
|
||||
"""Receive and parse request header into self.request."""
|
||||
# Receive until full header is in buffer
|
||||
buf = self.recv_buffer
|
||||
pos = 0
|
||||
|
||||
while True:
|
||||
pos = buf.find(b"\r\n\r\n", pos)
|
||||
if pos != -1:
|
||||
break
|
||||
|
||||
pos = max(0, len(buf) - 3)
|
||||
if pos >= self.HEADER_MAX_SIZE:
|
||||
break
|
||||
|
||||
await self._receive_more()
|
||||
|
||||
if pos >= self.HEADER_MAX_SIZE:
|
||||
raise PayloadTooLarge("Request header exceeds the size limit")
|
||||
|
||||
# Parse header content
|
||||
try:
|
||||
head = buf[:pos]
|
||||
raw_headers = head.decode(errors="surrogateescape")
|
||||
reqline, *split_headers = raw_headers.split("\r\n")
|
||||
method, self.url, protocol = reqline.split(" ")
|
||||
|
||||
await self.dispatch(
|
||||
"http.lifecycle.read_head",
|
||||
inline=True,
|
||||
context={"head": bytes(head)},
|
||||
)
|
||||
|
||||
if protocol == "HTTP/1.1":
|
||||
self.keep_alive = True
|
||||
elif protocol == "HTTP/1.0":
|
||||
self.keep_alive = False
|
||||
else:
|
||||
raise Exception # Raise a Bad Request on try-except
|
||||
|
||||
self.head_only = method.upper() == "HEAD"
|
||||
request_body = False
|
||||
headers = []
|
||||
|
||||
for name, value in (h.split(":", 1) for h in split_headers):
|
||||
name, value = h = name.lower(), value.lstrip()
|
||||
|
||||
if name in ("content-length", "transfer-encoding"):
|
||||
if request_body:
|
||||
raise ValueError(
|
||||
"Duplicate Content-Length or Transfer-Encoding"
|
||||
)
|
||||
request_body = True
|
||||
elif name == "connection":
|
||||
self.keep_alive = value.lower() == "keep-alive"
|
||||
|
||||
headers.append(h)
|
||||
except Exception:
|
||||
raise BadRequest("Bad Request")
|
||||
|
||||
if not self.protocol.app.config.KEEP_ALIVE:
|
||||
self.keep_alive = False
|
||||
|
||||
headers_instance = Header(headers)
|
||||
self.upgrade_websocket = (
|
||||
headers_instance.getone("upgrade", "").lower() == "websocket"
|
||||
)
|
||||
|
||||
try:
|
||||
url_bytes = self.url.encode("ASCII")
|
||||
except UnicodeEncodeError:
|
||||
raise BadRequest("URL may only contain US-ASCII characters.")
|
||||
|
||||
# Prepare a Request object
|
||||
request = self.protocol.request_class(
|
||||
url_bytes=url_bytes,
|
||||
headers=headers_instance,
|
||||
head=bytes(head),
|
||||
version=protocol[5:],
|
||||
method=method,
|
||||
transport=self.protocol.transport,
|
||||
app=self.protocol.app,
|
||||
)
|
||||
self.protocol.request_class._current.set(request)
|
||||
await self.dispatch(
|
||||
"http.lifecycle.request",
|
||||
inline=True,
|
||||
context={"request": request},
|
||||
)
|
||||
|
||||
# Prepare for request body
|
||||
self.request_bytes_left = self.request_bytes = 0
|
||||
if request_body:
|
||||
headers = request.headers
|
||||
expect = headers.getone("expect", None)
|
||||
|
||||
if expect is not None:
|
||||
if expect.lower() == "100-continue":
|
||||
self.expecting_continue = True
|
||||
else:
|
||||
raise ExpectationFailed(f"Unknown Expect: {expect}")
|
||||
|
||||
if headers.getone("transfer-encoding", None) == "chunked":
|
||||
self.request_body = "chunked"
|
||||
pos -= 2 # One CRLF stays in buffer
|
||||
else:
|
||||
self.request_body = True
|
||||
try:
|
||||
self.request_bytes_left = self.request_bytes = (
|
||||
self._safe_int(headers["content-length"])
|
||||
)
|
||||
except Exception:
|
||||
raise BadRequest("Bad content-length")
|
||||
|
||||
# Remove header and its trailing CRLF
|
||||
del buf[: pos + 4]
|
||||
self.request, request.stream = request, self
|
||||
self.protocol.state["requests_count"] += 1
|
||||
|
||||
async def http1_response_header(
|
||||
self, data: bytes, end_stream: bool
|
||||
) -> None: # no cov
|
||||
"""Format response header and send it."""
|
||||
res = self.response
|
||||
|
||||
# Compatibility with simple response body
|
||||
if not data and getattr(res, "body", None):
|
||||
data, end_stream = res.body, True # type: ignore
|
||||
|
||||
size = len(data)
|
||||
headers = res.headers
|
||||
status = res.status
|
||||
self.response_size = size
|
||||
|
||||
if not isinstance(status, int) or status < 200:
|
||||
raise RuntimeError(f"Invalid response status {status!r}")
|
||||
|
||||
if not has_message_body(status):
|
||||
# Header-only response status
|
||||
self.response_func = None
|
||||
if (
|
||||
data
|
||||
or not end_stream
|
||||
or "content-length" in headers
|
||||
or "transfer-encoding" in headers
|
||||
):
|
||||
data, size, end_stream = b"", 0, True
|
||||
headers.pop("content-length", None)
|
||||
headers.pop("transfer-encoding", None)
|
||||
logger.warning(
|
||||
f"Message body set in response on {self.request.path}. "
|
||||
f"A {status} response may only have headers, no body."
|
||||
)
|
||||
elif self.head_only and "content-length" in headers:
|
||||
self.response_func = None
|
||||
elif end_stream:
|
||||
# Non-streaming response (all in one block)
|
||||
headers["content-length"] = size
|
||||
self.response_func = None
|
||||
elif "content-length" in headers:
|
||||
# Streaming response with size known in advance
|
||||
self.response_bytes_left = int(headers["content-length"]) - size
|
||||
self.response_func = self.http1_response_normal
|
||||
else:
|
||||
# Length not known, use chunked encoding
|
||||
headers["transfer-encoding"] = "chunked"
|
||||
data = b"%x\r\n%b\r\n" % (size, data) if size else b""
|
||||
self.response_func = self.http1_response_chunked
|
||||
|
||||
if self.head_only:
|
||||
# Head request: don't send body
|
||||
data = b""
|
||||
self.response_func = self.head_response_ignored
|
||||
|
||||
headers["connection"] = "keep-alive" if self.keep_alive else "close"
|
||||
|
||||
# This header may be removed or modified by the AltSvcCheck Touchup
|
||||
# service. At server start, we either remove this header from ever
|
||||
# being assigned, or we change the value as required.
|
||||
headers["alt-svc"] = ""
|
||||
|
||||
ret = format_http1_response(status, res.processed_headers)
|
||||
if data:
|
||||
ret += data
|
||||
|
||||
# Send a 100-continue if expected and not Expectation Failed
|
||||
if self.expecting_continue:
|
||||
self.expecting_continue = False
|
||||
if status != 417:
|
||||
ret = HTTP_CONTINUE + ret
|
||||
|
||||
# Send response
|
||||
if self.protocol.access_log:
|
||||
self.log_response()
|
||||
|
||||
await self._send(ret)
|
||||
self.stage = Stage.IDLE if end_stream else Stage.RESPONSE
|
||||
|
||||
def head_response_ignored(self, data: bytes, end_stream: bool) -> None:
|
||||
"""HEAD response: body data silently ignored."""
|
||||
if end_stream:
|
||||
self.response_func = None
|
||||
self.stage = Stage.IDLE
|
||||
|
||||
async def http1_response_chunked(
|
||||
self, data: bytes, end_stream: bool
|
||||
) -> None:
|
||||
"""Format a part of response body in chunked encoding."""
|
||||
# Chunked encoding
|
||||
size = len(data)
|
||||
if end_stream:
|
||||
await self._send(
|
||||
b"%x\r\n%b\r\n0\r\n\r\n" % (size, data)
|
||||
if size
|
||||
else b"0\r\n\r\n"
|
||||
)
|
||||
self.response_func = None
|
||||
self.stage = Stage.IDLE
|
||||
elif size:
|
||||
await self._send(b"%x\r\n%b\r\n" % (size, data))
|
||||
|
||||
async def http1_response_normal(
|
||||
self, data: bytes, end_stream: bool
|
||||
) -> None:
|
||||
"""Format / keep track of non-chunked response."""
|
||||
bytes_left = self.response_bytes_left - len(data)
|
||||
if bytes_left <= 0:
|
||||
if bytes_left < 0:
|
||||
raise ServerError("Response was bigger than content-length")
|
||||
|
||||
await self._send(data)
|
||||
self.response_func = None
|
||||
self.stage = Stage.IDLE
|
||||
else:
|
||||
if end_stream:
|
||||
raise ServerError("Response was smaller than content-length")
|
||||
|
||||
await self._send(data)
|
||||
self.response_bytes_left = bytes_left
|
||||
|
||||
async def error_response(self, exception: Exception) -> None:
|
||||
"""Handle response when exception encountered"""
|
||||
# Disconnect after an error if in any other state than handler
|
||||
if self.stage is not Stage.HANDLER:
|
||||
self.keep_alive = False
|
||||
|
||||
# Request failure? Respond but then disconnect
|
||||
if self.stage is Stage.REQUEST:
|
||||
self.stage = Stage.HANDLER
|
||||
|
||||
# From request and handler states we can respond, otherwise be silent
|
||||
if self.stage is Stage.HANDLER:
|
||||
app = self.protocol.app
|
||||
|
||||
if self.request is None:
|
||||
self.create_empty_request()
|
||||
|
||||
request_middleware = not isinstance(
|
||||
exception, (ServiceUnavailable, RequestCancelled)
|
||||
)
|
||||
try:
|
||||
await app.handle_exception(
|
||||
self.request, exception, request_middleware
|
||||
)
|
||||
except Exception as e:
|
||||
await app.handle_exception(self.request, e, False)
|
||||
|
||||
def create_empty_request(self) -> None:
|
||||
"""Create an empty request object for error handling use.
|
||||
|
||||
Current error handling code needs a request object that won't exist
|
||||
if an error occurred during before a request was received. Create a
|
||||
bogus response for error handling use.
|
||||
"""
|
||||
|
||||
# Reformat any URL already received with \xHH escapes for better logs
|
||||
url_bytes = (
|
||||
self.url.encode(errors="surrogateescape")
|
||||
.decode("ASCII", errors="backslashreplace")
|
||||
.encode("ASCII")
|
||||
if self.url
|
||||
else b"*"
|
||||
)
|
||||
|
||||
# FIXME: Avoid this by refactoring error handling and response code
|
||||
self.request = self.protocol.request_class(
|
||||
url_bytes=url_bytes,
|
||||
headers=Header({}),
|
||||
version="1.1",
|
||||
method="NONE",
|
||||
transport=self.protocol.transport,
|
||||
app=self.protocol.app,
|
||||
)
|
||||
self.request.stream = self
|
||||
|
||||
def log_response(self) -> None:
|
||||
"""Helper method provided to enable the logging of responses in case if the `HttpProtocol.access_log` is enabled.""" # noqa: E501
|
||||
req, res = self.request, self.response
|
||||
extra = {
|
||||
"status": getattr(res, "status", 0),
|
||||
"byte": res.headers.get("content-length", 0)
|
||||
if res.headers.get("transfer-encoding") != "chunked"
|
||||
else "chunked",
|
||||
"host": f"{id(self.protocol.transport):X}"[-5:-1] + "unx",
|
||||
"request": "nil",
|
||||
"duration": (
|
||||
f" {1000 * (perf_counter() - self.perft0):.1f}ms"
|
||||
if self.perft0 is not None
|
||||
else ""
|
||||
),
|
||||
}
|
||||
if ip := req.client_ip:
|
||||
extra["host"] = f"{ip}:{req.port}"
|
||||
extra["request"] = f"{req.method} {req.url}"
|
||||
access_logger.info("", extra=extra)
|
||||
|
||||
# Request methods
|
||||
|
||||
async def __aiter__(self):
|
||||
"""Async iterate over request body."""
|
||||
while self.request_body:
|
||||
data = await self.read()
|
||||
|
||||
if data:
|
||||
yield data
|
||||
|
||||
async def read(self) -> bytes | None: # no cov
|
||||
"""Read some bytes of request body."""
|
||||
|
||||
# Send a 100-continue if needed
|
||||
if self.expecting_continue:
|
||||
self.expecting_continue = False
|
||||
await self._send(HTTP_CONTINUE)
|
||||
|
||||
# Receive request body chunk
|
||||
buf = self.recv_buffer
|
||||
if self.request_bytes_left == 0 and self.request_body == "chunked":
|
||||
# Process a chunk header: \r\n<size>[;<chunk extensions>]\r\n
|
||||
while True:
|
||||
pos = buf.find(b"\r\n", 3)
|
||||
|
||||
if pos != -1:
|
||||
break
|
||||
|
||||
if len(buf) > 64:
|
||||
self.keep_alive = False
|
||||
raise BadRequest("Bad chunked encoding")
|
||||
|
||||
await self._receive_more()
|
||||
|
||||
try:
|
||||
raw = buf[2:pos].split(b";", 1)[0].decode()
|
||||
size = self._safe_int(raw, 16)
|
||||
except Exception:
|
||||
self.keep_alive = False
|
||||
raise BadRequest("Bad chunked encoding")
|
||||
|
||||
if size <= 0:
|
||||
self.request_body = None
|
||||
|
||||
if size < 0:
|
||||
self.keep_alive = False
|
||||
raise BadRequest("Bad chunked encoding")
|
||||
|
||||
# Consume CRLF, chunk size 0 and the two CRLF that follow
|
||||
pos += 4
|
||||
# Might need to wait for the final CRLF
|
||||
while len(buf) < pos:
|
||||
await self._receive_more()
|
||||
del buf[:pos]
|
||||
return None
|
||||
|
||||
# Remove CRLF, chunk size and the CRLF that follows
|
||||
del buf[: pos + 2]
|
||||
|
||||
self.request_bytes_left = size
|
||||
self.request_bytes += size
|
||||
|
||||
# Request size limit
|
||||
if self.request_bytes > self.request_max_size:
|
||||
self.keep_alive = False
|
||||
raise PayloadTooLarge("Request body exceeds the size limit")
|
||||
|
||||
# End of request body?
|
||||
if not self.request_bytes_left:
|
||||
self.request_body = None
|
||||
return None
|
||||
|
||||
# At this point we are good to read/return up to request_bytes_left
|
||||
if not buf:
|
||||
await self._receive_more()
|
||||
|
||||
data = bytes(buf[: self.request_bytes_left])
|
||||
size = len(data)
|
||||
|
||||
del buf[:size]
|
||||
|
||||
self.request_bytes_left -= size
|
||||
|
||||
await self.dispatch(
|
||||
"http.lifecycle.read_body",
|
||||
inline=True,
|
||||
context={"body": data},
|
||||
)
|
||||
|
||||
return data
|
||||
|
||||
# Response methods
|
||||
|
||||
def respond(self, response: BaseHTTPResponse) -> BaseHTTPResponse:
|
||||
"""Initiate new streaming response.
|
||||
|
||||
Nothing is sent until the first send() call on the returned object, and
|
||||
calling this function multiple times will just alter the response to be
|
||||
given.
|
||||
"""
|
||||
if self.stage is not Stage.HANDLER:
|
||||
self.stage = Stage.FAILED
|
||||
raise RuntimeError("Response already started")
|
||||
|
||||
# Disconnect any earlier but unused response object
|
||||
if self.response is not None:
|
||||
self.response.stream = None
|
||||
|
||||
# Connect and return the response
|
||||
self.response, response.stream = response, self
|
||||
return response
|
||||
|
||||
@property
|
||||
def send(self):
|
||||
return self.response_func
|
||||
|
||||
@classmethod
|
||||
def set_header_max_size(cls, *sizes: int):
|
||||
cls.HEADER_MAX_SIZE = min(
|
||||
*sizes,
|
||||
cls.HEADER_CEILING,
|
||||
)
|
||||
|
||||
@staticmethod
|
||||
def _safe_int(value: str, base: int = 10) -> int:
|
||||
if "-" in value or "+" in value or "_" in value:
|
||||
raise ValueError
|
||||
return int(value, base)
|
||||
@@ -0,0 +1,423 @@
|
||||
from __future__ import annotations
|
||||
|
||||
import asyncio
|
||||
|
||||
from abc import ABC, abstractmethod
|
||||
from ssl import SSLContext
|
||||
from typing import TYPE_CHECKING, Any, Callable, cast
|
||||
|
||||
from sanic.compat import Header
|
||||
from sanic.constants import LocalCertCreator
|
||||
from sanic.exceptions import (
|
||||
BadRequest,
|
||||
PayloadTooLarge,
|
||||
SanicException,
|
||||
ServerError,
|
||||
)
|
||||
from sanic.helpers import has_message_body
|
||||
from sanic.http.constants import Stage
|
||||
from sanic.http.stream import Stream
|
||||
from sanic.http.tls.context import CertSelector, SanicSSLContext
|
||||
from sanic.log import Colors, logger
|
||||
from sanic.models.protocol_types import TransportProtocol
|
||||
from sanic.models.server_types import ConnInfo
|
||||
|
||||
|
||||
try:
|
||||
from aioquic.h0.connection import H0_ALPN, H0Connection
|
||||
from aioquic.h3.connection import H3_ALPN, H3Connection
|
||||
from aioquic.h3.events import (
|
||||
DatagramReceived,
|
||||
DataReceived,
|
||||
H3Event,
|
||||
HeadersReceived,
|
||||
WebTransportStreamDataReceived,
|
||||
)
|
||||
from aioquic.quic.configuration import QuicConfiguration
|
||||
from aioquic.tls import SessionTicket
|
||||
|
||||
HTTP3_AVAILABLE = True
|
||||
except ModuleNotFoundError: # no cov
|
||||
HTTP3_AVAILABLE = False
|
||||
|
||||
if TYPE_CHECKING:
|
||||
from sanic import Sanic
|
||||
from sanic.request import Request
|
||||
from sanic.response import BaseHTTPResponse
|
||||
from sanic.server.protocols.http_protocol import Http3Protocol
|
||||
|
||||
HttpConnection = H0Connection | H3Connection
|
||||
|
||||
|
||||
class HTTP3Transport(TransportProtocol):
|
||||
"""HTTP/3 transport implementation."""
|
||||
|
||||
__slots__ = ("_protocol",)
|
||||
|
||||
def __init__(self, protocol: Http3Protocol):
|
||||
self._protocol = protocol
|
||||
|
||||
def get_protocol(self) -> Http3Protocol:
|
||||
return self._protocol
|
||||
|
||||
def get_extra_info(self, info: str, default: Any = None) -> Any:
|
||||
if (
|
||||
info in ("socket", "sockname", "peername")
|
||||
and self._protocol._transport
|
||||
):
|
||||
return self._protocol._transport.get_extra_info(info, default)
|
||||
elif info == "network_paths":
|
||||
return self._protocol._quic._network_paths
|
||||
elif info == "ssl_context":
|
||||
return self._protocol.app.state.ssl
|
||||
return default
|
||||
|
||||
|
||||
class Receiver(ABC):
|
||||
"""HTTP/3 receiver base class."""
|
||||
|
||||
future: asyncio.Future
|
||||
|
||||
def __init__(self, transmit, protocol, request: Request) -> None:
|
||||
self.transmit = transmit
|
||||
self.protocol = protocol
|
||||
self.request = request
|
||||
|
||||
@abstractmethod
|
||||
async def run(self): # no cov
|
||||
...
|
||||
|
||||
|
||||
class HTTPReceiver(Receiver, Stream):
|
||||
"""HTTP/3 receiver implementation."""
|
||||
|
||||
stage: Stage
|
||||
request: Request
|
||||
|
||||
def __init__(self, *args, **kwargs) -> None:
|
||||
super().__init__(*args, **kwargs)
|
||||
self.request_body = None
|
||||
self.stage = Stage.IDLE
|
||||
self.headers_sent = False
|
||||
self.response: BaseHTTPResponse | None = None
|
||||
self.request_max_size = self.protocol.request_max_size
|
||||
self.request_bytes = 0
|
||||
|
||||
async def run(self, exception: Exception | None = None):
|
||||
"""Handle the request and response cycle."""
|
||||
self.stage = Stage.HANDLER
|
||||
self.head_only = self.request.method.upper() == "HEAD"
|
||||
|
||||
if exception:
|
||||
logger.info( # no cov
|
||||
f"{Colors.BLUE}[exception]: "
|
||||
f"{Colors.RED}{exception}{Colors.END}",
|
||||
exc_info=True,
|
||||
extra={"verbosity": 1},
|
||||
)
|
||||
await self.error_response(exception)
|
||||
else:
|
||||
try:
|
||||
logger.info( # no cov
|
||||
f"{Colors.BLUE}[request]:{Colors.END} {self.request}",
|
||||
extra={"verbosity": 1},
|
||||
)
|
||||
await self.protocol.request_handler(self.request)
|
||||
except Exception as e: # no cov
|
||||
# This should largely be handled within the request handler.
|
||||
# But, just in case...
|
||||
await self.run(e)
|
||||
self.stage = Stage.IDLE
|
||||
|
||||
async def error_response(self, exception: Exception) -> None:
|
||||
"""Handle response when exception encountered"""
|
||||
# From request and handler states we can respond, otherwise be silent
|
||||
app = self.protocol.app
|
||||
|
||||
await app.handle_exception(self.request, exception)
|
||||
|
||||
def _prepare_headers(
|
||||
self, response: BaseHTTPResponse
|
||||
) -> list[tuple[bytes, bytes]]:
|
||||
size = len(response.body) if response.body else 0
|
||||
headers = response.headers
|
||||
status = response.status
|
||||
|
||||
if not has_message_body(status) and (
|
||||
size
|
||||
or "content-length" in headers
|
||||
or "transfer-encoding" in headers
|
||||
):
|
||||
headers.pop("content-length", None)
|
||||
headers.pop("transfer-encoding", None)
|
||||
logger.warning( # no cov
|
||||
f"Message body set in response on {self.request.path}. "
|
||||
f"A {status} response may only have headers, no body."
|
||||
)
|
||||
elif "content-length" not in headers:
|
||||
if size:
|
||||
headers["content-length"] = size
|
||||
else:
|
||||
headers["transfer-encoding"] = "chunked"
|
||||
|
||||
headers = [
|
||||
(b":status", str(response.status).encode()),
|
||||
*response.processed_headers,
|
||||
]
|
||||
return headers
|
||||
|
||||
def send_headers(self) -> None:
|
||||
"""Send response headers to client"""
|
||||
logger.debug( # no cov
|
||||
f"{Colors.BLUE}[send]: {Colors.GREEN}HEADERS{Colors.END}",
|
||||
extra={"verbosity": 2},
|
||||
)
|
||||
if not self.response:
|
||||
raise RuntimeError("no response")
|
||||
|
||||
response = self.response
|
||||
headers = self._prepare_headers(response)
|
||||
|
||||
self.protocol.connection.send_headers(
|
||||
stream_id=self.request.stream_id,
|
||||
headers=headers,
|
||||
)
|
||||
self.headers_sent = True
|
||||
self.stage = Stage.RESPONSE
|
||||
|
||||
if self.response.body and not self.head_only:
|
||||
self._send(self.response.body, False)
|
||||
elif self.head_only:
|
||||
self.future.cancel()
|
||||
|
||||
def respond(self, response: BaseHTTPResponse) -> BaseHTTPResponse:
|
||||
"""Prepare response to client"""
|
||||
logger.debug( # no cov
|
||||
f"{Colors.BLUE}[respond]:{Colors.END} {response}",
|
||||
extra={"verbosity": 2},
|
||||
)
|
||||
|
||||
if self.stage is not Stage.HANDLER:
|
||||
self.stage = Stage.FAILED
|
||||
raise RuntimeError("Response already started")
|
||||
|
||||
# Disconnect any earlier but unused response object
|
||||
if self.response is not None:
|
||||
self.response.stream = None
|
||||
|
||||
self.response, response.stream = response, self
|
||||
|
||||
return response
|
||||
|
||||
def receive_body(self, data: bytes) -> None:
|
||||
"""Receive request body from client"""
|
||||
self.request_bytes += len(data)
|
||||
if self.request_bytes > self.request_max_size:
|
||||
raise PayloadTooLarge("Request body exceeds the size limit")
|
||||
|
||||
self.request.body += data
|
||||
|
||||
async def send(self, data: bytes, end_stream: bool) -> None:
|
||||
"""Send data to client"""
|
||||
logger.debug( # no cov
|
||||
f"{Colors.BLUE}[send]: {Colors.GREEN}data={data.decode()} "
|
||||
f"end_stream={end_stream}{Colors.END}",
|
||||
extra={"verbosity": 2},
|
||||
)
|
||||
self._send(data, end_stream)
|
||||
|
||||
def _send(self, data: bytes, end_stream: bool) -> None:
|
||||
if not self.headers_sent:
|
||||
self.send_headers()
|
||||
if self.stage is not Stage.RESPONSE:
|
||||
raise ServerError(f"not ready to send: {self.stage}")
|
||||
|
||||
# Chunked
|
||||
if (
|
||||
self.response
|
||||
and self.response.headers.get("transfer-encoding") == "chunked"
|
||||
):
|
||||
size = len(data)
|
||||
if end_stream:
|
||||
data = (
|
||||
b"%x\r\n%b\r\n0\r\n\r\n" % (size, data)
|
||||
if size
|
||||
else b"0\r\n\r\n"
|
||||
)
|
||||
elif size:
|
||||
data = b"%x\r\n%b\r\n" % (size, data)
|
||||
|
||||
logger.debug( # no cov
|
||||
f"{Colors.BLUE}[transmitting]{Colors.END}",
|
||||
extra={"verbosity": 2},
|
||||
)
|
||||
self.protocol.connection.send_data(
|
||||
stream_id=self.request.stream_id,
|
||||
data=data,
|
||||
end_stream=end_stream,
|
||||
)
|
||||
self.transmit()
|
||||
|
||||
if end_stream:
|
||||
self.stage = Stage.IDLE
|
||||
|
||||
|
||||
class WebsocketReceiver(Receiver): # noqa
|
||||
"""Websocket receiver implementation."""
|
||||
|
||||
async def run(self): ...
|
||||
|
||||
|
||||
class WebTransportReceiver(Receiver): # noqa
|
||||
"""WebTransport receiver implementation."""
|
||||
|
||||
async def run(self): ...
|
||||
|
||||
|
||||
class Http3:
|
||||
"""Internal helper for managing the HTTP/3 request/response cycle"""
|
||||
|
||||
if HTTP3_AVAILABLE:
|
||||
HANDLER_PROPERTY_MAPPING = {
|
||||
DataReceived: "stream_id",
|
||||
HeadersReceived: "stream_id",
|
||||
DatagramReceived: "flow_id",
|
||||
WebTransportStreamDataReceived: "session_id",
|
||||
}
|
||||
|
||||
def __init__(
|
||||
self,
|
||||
protocol: Http3Protocol,
|
||||
transmit: Callable[[], None],
|
||||
) -> None:
|
||||
self.protocol = protocol
|
||||
self.transmit = transmit
|
||||
self.receivers: dict[int, Receiver] = {}
|
||||
|
||||
def http_event_received(self, event: H3Event) -> None:
|
||||
logger.debug( # no cov
|
||||
f"{Colors.BLUE}[http_event_received]: "
|
||||
f"{Colors.YELLOW}{event}{Colors.END}",
|
||||
extra={"verbosity": 2},
|
||||
)
|
||||
receiver, created_new = self.get_or_make_receiver(event)
|
||||
receiver = cast(HTTPReceiver, receiver)
|
||||
|
||||
if isinstance(event, HeadersReceived) and created_new:
|
||||
receiver.future = asyncio.ensure_future(receiver.run())
|
||||
elif isinstance(event, DataReceived):
|
||||
try:
|
||||
receiver.receive_body(event.data)
|
||||
except Exception as e:
|
||||
receiver.future.cancel()
|
||||
receiver.future = asyncio.ensure_future(receiver.run(e))
|
||||
else:
|
||||
... # Intentionally here to help out Touchup
|
||||
logger.debug( # no cov
|
||||
f"{Colors.RED}DOING NOTHING{Colors.END}",
|
||||
extra={"verbosity": 2},
|
||||
)
|
||||
|
||||
def get_or_make_receiver(self, event: H3Event) -> tuple[Receiver, bool]:
|
||||
if (
|
||||
isinstance(event, HeadersReceived)
|
||||
and event.stream_id not in self.receivers
|
||||
):
|
||||
request = self._make_request(event)
|
||||
receiver = HTTPReceiver(self.transmit, self.protocol, request)
|
||||
request.stream = receiver
|
||||
|
||||
self.receivers[event.stream_id] = receiver
|
||||
return receiver, True
|
||||
else:
|
||||
ident = getattr(event, self.HANDLER_PROPERTY_MAPPING[type(event)])
|
||||
return self.receivers[ident], False
|
||||
|
||||
def get_receiver_by_stream_id(self, stream_id: int) -> Receiver:
|
||||
return self.receivers[stream_id]
|
||||
|
||||
def _make_request(self, event: HeadersReceived) -> Request:
|
||||
try:
|
||||
headers = Header(
|
||||
(
|
||||
(k.decode("ASCII"), v.decode(errors="surrogateescape"))
|
||||
for k, v in event.headers
|
||||
)
|
||||
)
|
||||
except UnicodeDecodeError:
|
||||
raise BadRequest(
|
||||
"Header names may only contain US-ASCII characters."
|
||||
)
|
||||
method = headers[":method"]
|
||||
path = headers[":path"]
|
||||
scheme = headers.pop(":scheme", "")
|
||||
authority = headers.pop(":authority", "")
|
||||
|
||||
if authority:
|
||||
headers["host"] = authority
|
||||
|
||||
try:
|
||||
url_bytes = path.encode("ASCII")
|
||||
except UnicodeEncodeError:
|
||||
raise BadRequest("URL may only contain US-ASCII characters.")
|
||||
|
||||
transport = HTTP3Transport(self.protocol)
|
||||
request = self.protocol.request_class(
|
||||
url_bytes,
|
||||
headers,
|
||||
"3",
|
||||
method,
|
||||
transport,
|
||||
self.protocol.app,
|
||||
b"",
|
||||
)
|
||||
request.conn_info = ConnInfo(transport)
|
||||
request._stream_id = event.stream_id
|
||||
request._scheme = scheme
|
||||
|
||||
return request
|
||||
|
||||
|
||||
class SessionTicketStore:
|
||||
"""
|
||||
Simple in-memory store for session tickets.
|
||||
"""
|
||||
|
||||
def __init__(self) -> None:
|
||||
self.tickets: dict[bytes, SessionTicket] = {}
|
||||
|
||||
def add(self, ticket: SessionTicket) -> None:
|
||||
self.tickets[ticket.ticket] = ticket
|
||||
|
||||
def pop(self, label: bytes) -> SessionTicket | None:
|
||||
return self.tickets.pop(label, None)
|
||||
|
||||
|
||||
def get_config(app: Sanic, ssl: SanicSSLContext | CertSelector | SSLContext):
|
||||
# TODO:
|
||||
# - proper selection needed if service with multiple certs insted of
|
||||
# just taking the first
|
||||
if isinstance(ssl, CertSelector):
|
||||
ssl = cast(SanicSSLContext, ssl.sanic_select[0])
|
||||
if app.config.LOCAL_CERT_CREATOR is LocalCertCreator.TRUSTME:
|
||||
raise SanicException(
|
||||
"Sorry, you cannot currently use trustme as a local certificate "
|
||||
"generator for an HTTP/3 server. This is not yet supported. You "
|
||||
"should be able to use mkcert instead. For more information, see: "
|
||||
"https://github.com/aiortc/aioquic/issues/295."
|
||||
)
|
||||
if not isinstance(ssl, SanicSSLContext):
|
||||
raise SanicException("SSLContext is not SanicSSLContext")
|
||||
|
||||
config = QuicConfiguration(
|
||||
alpn_protocols=H3_ALPN + H0_ALPN + ["siduck"],
|
||||
is_client=False,
|
||||
max_datagram_frame_size=65536,
|
||||
)
|
||||
password = app.config.TLS_CERT_PASSWORD or None
|
||||
|
||||
config.load_cert_chain(
|
||||
ssl.sanic["cert"], ssl.sanic["key"], password=password
|
||||
)
|
||||
|
||||
return config
|
||||
@@ -0,0 +1,27 @@
|
||||
from __future__ import annotations
|
||||
|
||||
from typing import TYPE_CHECKING
|
||||
|
||||
from sanic.http.constants import Stage
|
||||
|
||||
|
||||
if TYPE_CHECKING:
|
||||
from sanic.response import BaseHTTPResponse
|
||||
from sanic.server.protocols.http_protocol import HttpProtocol
|
||||
|
||||
|
||||
class Stream:
|
||||
stage: Stage
|
||||
response: BaseHTTPResponse | None
|
||||
protocol: HttpProtocol
|
||||
url: str | None
|
||||
request_body: bytes | None
|
||||
request_max_size: int | float
|
||||
|
||||
__touchup__: tuple[str, ...] = tuple()
|
||||
__slots__ = ("request_max_size",)
|
||||
|
||||
def respond(
|
||||
self, response: BaseHTTPResponse
|
||||
) -> BaseHTTPResponse: # no cov
|
||||
raise NotImplementedError("Not implemented")
|
||||
@@ -0,0 +1,5 @@
|
||||
from .context import process_to_context
|
||||
from .creators import get_ssl_context
|
||||
|
||||
|
||||
__all__ = ("get_ssl_context", "process_to_context")
|
||||
@@ -0,0 +1,210 @@
|
||||
from __future__ import annotations
|
||||
|
||||
import os
|
||||
import ssl
|
||||
|
||||
from collections.abc import Iterable
|
||||
from typing import Any
|
||||
|
||||
from sanic.log import logger
|
||||
|
||||
|
||||
# Only allow secure ciphers, notably leaving out AES-CBC mode
|
||||
# OpenSSL chooses ECDSA or RSA depending on the cert in use
|
||||
CIPHERS_TLS12 = [
|
||||
"ECDHE-ECDSA-CHACHA20-POLY1305",
|
||||
"ECDHE-ECDSA-AES256-GCM-SHA384",
|
||||
"ECDHE-ECDSA-AES128-GCM-SHA256",
|
||||
"ECDHE-RSA-CHACHA20-POLY1305",
|
||||
"ECDHE-RSA-AES256-GCM-SHA384",
|
||||
"ECDHE-RSA-AES128-GCM-SHA256",
|
||||
]
|
||||
|
||||
|
||||
def create_context(
|
||||
certfile: str | None = None,
|
||||
keyfile: str | None = None,
|
||||
password: str | None = None,
|
||||
purpose: ssl.Purpose = ssl.Purpose.CLIENT_AUTH,
|
||||
) -> ssl.SSLContext:
|
||||
"""Create a context with secure crypto and HTTP/1.1 in protocols."""
|
||||
context = ssl.create_default_context(purpose=purpose)
|
||||
context.minimum_version = ssl.TLSVersion.TLSv1_2
|
||||
context.set_ciphers(":".join(CIPHERS_TLS12))
|
||||
context.set_alpn_protocols(["http/1.1"])
|
||||
if purpose is ssl.Purpose.CLIENT_AUTH:
|
||||
context.sni_callback = server_name_callback
|
||||
if certfile and keyfile:
|
||||
context.load_cert_chain(certfile, keyfile, password)
|
||||
return context
|
||||
|
||||
|
||||
def shorthand_to_ctx(
|
||||
ctxdef: None | ssl.SSLContext | dict | str,
|
||||
) -> ssl.SSLContext | None:
|
||||
"""Convert an ssl argument shorthand to an SSLContext object."""
|
||||
if ctxdef is None or isinstance(ctxdef, ssl.SSLContext):
|
||||
return ctxdef
|
||||
if isinstance(ctxdef, str):
|
||||
return load_cert_dir(ctxdef)
|
||||
if isinstance(ctxdef, dict):
|
||||
return CertSimple(**ctxdef)
|
||||
raise ValueError(
|
||||
f"Invalid ssl argument {type(ctxdef)}."
|
||||
" Expecting a list of certdirs, a dict or an SSLContext."
|
||||
)
|
||||
|
||||
|
||||
def process_to_context(
|
||||
ssldef: None | ssl.SSLContext | dict | str | list | tuple,
|
||||
) -> ssl.SSLContext | None:
|
||||
"""Process app.run ssl argument from easy formats to full SSLContext."""
|
||||
return (
|
||||
CertSelector(map(shorthand_to_ctx, ssldef))
|
||||
if isinstance(ssldef, (list, tuple))
|
||||
else shorthand_to_ctx(ssldef)
|
||||
)
|
||||
|
||||
|
||||
def load_cert_dir(p: str) -> ssl.SSLContext:
|
||||
if os.path.isfile(p):
|
||||
raise ValueError(f"Certificate folder expected but {p} is a file.")
|
||||
keyfile = os.path.join(p, "privkey.pem")
|
||||
certfile = os.path.join(p, "fullchain.pem")
|
||||
if not os.access(keyfile, os.R_OK):
|
||||
raise ValueError(
|
||||
f"Certificate not found or permission denied {keyfile}"
|
||||
)
|
||||
if not os.access(certfile, os.R_OK):
|
||||
raise ValueError(
|
||||
f"Certificate not found or permission denied {certfile}"
|
||||
)
|
||||
return CertSimple(certfile, keyfile)
|
||||
|
||||
|
||||
def find_cert(self: CertSelector, server_name: str):
|
||||
"""Find the first certificate that matches the given SNI.
|
||||
|
||||
:raises ssl.CertificateError: No matching certificate found.
|
||||
:return: A matching ssl.SSLContext object if found."""
|
||||
if not server_name:
|
||||
if self.sanic_fallback:
|
||||
return self.sanic_fallback
|
||||
raise ValueError(
|
||||
"The client provided no SNI to match for certificate."
|
||||
)
|
||||
for ctx in self.sanic_select:
|
||||
if match_hostname(ctx, server_name):
|
||||
return ctx
|
||||
if self.sanic_fallback:
|
||||
return self.sanic_fallback
|
||||
raise ValueError(f"No certificate found matching hostname {server_name!r}")
|
||||
|
||||
|
||||
def match_hostname(ctx: ssl.SSLContext | CertSelector, hostname: str) -> bool:
|
||||
"""Match names from CertSelector against a received hostname."""
|
||||
# Local certs are considered trusted, so this can be less pedantic
|
||||
# and thus faster than the deprecated ssl.match_hostname function is.
|
||||
names = dict(getattr(ctx, "sanic", {})).get("names", [])
|
||||
hostname = hostname.lower()
|
||||
for name in names:
|
||||
if name.startswith("*."):
|
||||
if hostname.split(".", 1)[-1] == name[2:]:
|
||||
return True
|
||||
elif name == hostname:
|
||||
return True
|
||||
return False
|
||||
|
||||
|
||||
def selector_sni_callback(
|
||||
sslobj: ssl.SSLObject, server_name: str, ctx: CertSelector
|
||||
) -> int | None:
|
||||
"""Select a certificate matching the SNI."""
|
||||
# Call server_name_callback to store the SNI on sslobj
|
||||
server_name_callback(sslobj, server_name, ctx)
|
||||
# Find a new context matching the hostname
|
||||
try:
|
||||
sslobj.context = find_cert(ctx, server_name)
|
||||
except ValueError as e:
|
||||
logger.warning(f"Rejecting TLS connection: {e}")
|
||||
# This would show ERR_SSL_UNRECOGNIZED_NAME_ALERT on client side if
|
||||
# asyncio/uvloop did proper SSL shutdown. They don't.
|
||||
return ssl.ALERT_DESCRIPTION_UNRECOGNIZED_NAME
|
||||
return None # mypy complains without explicit return
|
||||
|
||||
|
||||
def server_name_callback(
|
||||
sslobj: ssl.SSLObject, server_name: str, ctx: ssl.SSLContext
|
||||
) -> None:
|
||||
"""Store the received SNI as sslobj.sanic_server_name."""
|
||||
sslobj.sanic_server_name = server_name # type: ignore
|
||||
|
||||
|
||||
class SanicSSLContext(ssl.SSLContext):
|
||||
sanic: dict[str, os.PathLike]
|
||||
|
||||
@classmethod
|
||||
def create_from_ssl_context(cls, context: ssl.SSLContext):
|
||||
context.__class__ = cls
|
||||
return context
|
||||
|
||||
|
||||
class CertSimple(SanicSSLContext):
|
||||
"""A wrapper for creating SSLContext with a sanic attribute."""
|
||||
|
||||
sanic: dict[str, Any]
|
||||
|
||||
def __new__(cls, cert, key, **kw):
|
||||
# try common aliases, rename to cert/key
|
||||
certfile = kw["cert"] = kw.pop("certificate", None) or cert
|
||||
keyfile = kw["key"] = kw.pop("keyfile", None) or key
|
||||
password = kw.get("password", None)
|
||||
if not certfile or not keyfile:
|
||||
raise ValueError("SSL dict needs filenames for cert and key.")
|
||||
subject = {}
|
||||
if "names" not in kw:
|
||||
cert = ssl._ssl._test_decode_cert(certfile) # type: ignore
|
||||
kw["names"] = [
|
||||
name
|
||||
for t, name in cert["subjectAltName"]
|
||||
if t in ["DNS", "IP Address"]
|
||||
]
|
||||
subject = {k: v for item in cert["subject"] for k, v in item}
|
||||
self = create_context(certfile, keyfile, password)
|
||||
self.__class__ = cls
|
||||
self.sanic = {**subject, **kw}
|
||||
return self
|
||||
|
||||
def __init__(self, cert, key, **kw):
|
||||
pass # Do not call super().__init__ because it is already initialized
|
||||
|
||||
|
||||
class CertSelector(ssl.SSLContext):
|
||||
"""Automatically select SSL certificate based on the hostname that the
|
||||
client is trying to access, via SSL SNI. Paths to certificate folders
|
||||
with privkey.pem and fullchain.pem in them should be provided, and
|
||||
will be matched in the order given whenever there is a new connection.
|
||||
"""
|
||||
|
||||
def __new__(cls, ctxs):
|
||||
return super().__new__(cls)
|
||||
|
||||
def __init__(self, ctxs: Iterable[ssl.SSLContext | None]):
|
||||
super().__init__()
|
||||
self.sni_callback = selector_sni_callback # type: ignore
|
||||
self.sanic_select = []
|
||||
self.sanic_fallback = None
|
||||
all_names = []
|
||||
for i, ctx in enumerate(ctxs):
|
||||
if not ctx:
|
||||
continue
|
||||
names = dict(getattr(ctx, "sanic", {})).get("names", [])
|
||||
all_names += names
|
||||
self.sanic_select.append(ctx)
|
||||
if i == 0:
|
||||
self.sanic_fallback = ctx
|
||||
if not all_names:
|
||||
raise ValueError(
|
||||
"No certificates with SubjectAlternativeNames found."
|
||||
)
|
||||
logger.info(f"Certificate vhosts: {', '.join(all_names)}")
|
||||
@@ -0,0 +1,287 @@
|
||||
from __future__ import annotations
|
||||
|
||||
import ssl
|
||||
import subprocess
|
||||
import sys
|
||||
|
||||
from abc import ABC, abstractmethod
|
||||
from contextlib import suppress
|
||||
from pathlib import Path
|
||||
from tempfile import mkdtemp
|
||||
from types import ModuleType
|
||||
from typing import TYPE_CHECKING, cast
|
||||
|
||||
from sanic.application.constants import Mode
|
||||
from sanic.application.spinner import loading
|
||||
from sanic.constants import (
|
||||
DEFAULT_LOCAL_TLS_CERT,
|
||||
DEFAULT_LOCAL_TLS_KEY,
|
||||
LocalCertCreator,
|
||||
)
|
||||
from sanic.exceptions import SanicException
|
||||
from sanic.helpers import Default
|
||||
from sanic.http.tls.context import CertSimple, SanicSSLContext
|
||||
|
||||
|
||||
try:
|
||||
import trustme
|
||||
|
||||
TRUSTME_INSTALLED = True
|
||||
except (ImportError, ModuleNotFoundError):
|
||||
trustme = ModuleType("trustme")
|
||||
TRUSTME_INSTALLED = False
|
||||
|
||||
if TYPE_CHECKING:
|
||||
from sanic import Sanic
|
||||
|
||||
|
||||
# Only allow secure ciphers, notably leaving out AES-CBC mode
|
||||
# OpenSSL chooses ECDSA or RSA depending on the cert in use
|
||||
CIPHERS_TLS12 = [
|
||||
"ECDHE-ECDSA-CHACHA20-POLY1305",
|
||||
"ECDHE-ECDSA-AES256-GCM-SHA384",
|
||||
"ECDHE-ECDSA-AES128-GCM-SHA256",
|
||||
"ECDHE-RSA-CHACHA20-POLY1305",
|
||||
"ECDHE-RSA-AES256-GCM-SHA384",
|
||||
"ECDHE-RSA-AES128-GCM-SHA256",
|
||||
]
|
||||
|
||||
|
||||
def _make_path(maybe_path: Path | str, tmpdir: Path | None) -> Path:
|
||||
if isinstance(maybe_path, Path):
|
||||
return maybe_path
|
||||
else:
|
||||
path = Path(maybe_path)
|
||||
if not path.exists():
|
||||
if not tmpdir:
|
||||
raise RuntimeError("Reached an unknown state. No tmpdir.")
|
||||
return tmpdir / maybe_path
|
||||
|
||||
return path
|
||||
|
||||
|
||||
def get_ssl_context(app: Sanic, ssl: ssl.SSLContext | None) -> ssl.SSLContext:
|
||||
if ssl:
|
||||
return ssl
|
||||
|
||||
if app.state.mode is Mode.PRODUCTION:
|
||||
raise SanicException(
|
||||
"Cannot run Sanic as an HTTPS server in PRODUCTION mode "
|
||||
"without passing a TLS certificate. If you are developing "
|
||||
"locally, please enable DEVELOPMENT mode and Sanic will "
|
||||
"generate a localhost TLS certificate. For more information "
|
||||
"please see: https://sanic.dev/en/guide/deployment/development."
|
||||
"html#automatic-tls-certificate."
|
||||
)
|
||||
|
||||
creator = CertCreator.select(
|
||||
app,
|
||||
cast(LocalCertCreator, app.config.LOCAL_CERT_CREATOR),
|
||||
app.config.LOCAL_TLS_KEY,
|
||||
app.config.LOCAL_TLS_CERT,
|
||||
)
|
||||
context = creator.generate_cert(app.config.LOCALHOST)
|
||||
return context
|
||||
|
||||
|
||||
class CertCreator(ABC):
|
||||
def __init__(self, app, key, cert) -> None:
|
||||
self.app = app
|
||||
self.key = key
|
||||
self.cert = cert
|
||||
self.tmpdir = None
|
||||
|
||||
if isinstance(self.key, Default) or isinstance(self.cert, Default):
|
||||
self.tmpdir = Path(mkdtemp())
|
||||
|
||||
key = (
|
||||
DEFAULT_LOCAL_TLS_KEY
|
||||
if isinstance(self.key, Default)
|
||||
else self.key
|
||||
)
|
||||
cert = (
|
||||
DEFAULT_LOCAL_TLS_CERT
|
||||
if isinstance(self.cert, Default)
|
||||
else self.cert
|
||||
)
|
||||
|
||||
self.key_path = _make_path(key, self.tmpdir)
|
||||
self.cert_path = _make_path(cert, self.tmpdir)
|
||||
|
||||
@abstractmethod
|
||||
def check_supported(self) -> None: # no cov
|
||||
...
|
||||
|
||||
@abstractmethod
|
||||
def generate_cert(self, localhost: str) -> ssl.SSLContext: # no cov
|
||||
...
|
||||
|
||||
@classmethod
|
||||
def select(
|
||||
cls,
|
||||
app: Sanic,
|
||||
cert_creator: LocalCertCreator,
|
||||
local_tls_key,
|
||||
local_tls_cert,
|
||||
) -> CertCreator:
|
||||
creator: CertCreator | None = None
|
||||
|
||||
cert_creator_options: tuple[
|
||||
tuple[type[CertCreator], LocalCertCreator], ...
|
||||
] = (
|
||||
(MkcertCreator, LocalCertCreator.MKCERT),
|
||||
(TrustmeCreator, LocalCertCreator.TRUSTME),
|
||||
)
|
||||
for creator_class, local_creator in cert_creator_options:
|
||||
creator = cls._try_select(
|
||||
app,
|
||||
creator,
|
||||
creator_class,
|
||||
local_creator,
|
||||
cert_creator,
|
||||
local_tls_key,
|
||||
local_tls_cert,
|
||||
)
|
||||
if creator:
|
||||
break
|
||||
|
||||
if not creator:
|
||||
raise SanicException(
|
||||
"Sanic could not find package to create a TLS certificate. "
|
||||
"You must have either mkcert or trustme installed. See "
|
||||
"https://sanic.dev/en/guide/deployment/development.html"
|
||||
"#automatic-tls-certificate for more details."
|
||||
)
|
||||
|
||||
return creator
|
||||
|
||||
@staticmethod
|
||||
def _try_select(
|
||||
app: Sanic,
|
||||
creator: CertCreator | None,
|
||||
creator_class: type[CertCreator],
|
||||
creator_requirement: LocalCertCreator,
|
||||
creator_requested: LocalCertCreator,
|
||||
local_tls_key,
|
||||
local_tls_cert,
|
||||
):
|
||||
if creator or (
|
||||
creator_requested is not LocalCertCreator.AUTO
|
||||
and creator_requested is not creator_requirement
|
||||
):
|
||||
return creator
|
||||
|
||||
instance = creator_class(app, local_tls_key, local_tls_cert)
|
||||
try:
|
||||
instance.check_supported()
|
||||
except SanicException:
|
||||
if creator_requested is creator_requirement:
|
||||
raise
|
||||
else:
|
||||
return None
|
||||
|
||||
return instance
|
||||
|
||||
|
||||
class MkcertCreator(CertCreator):
|
||||
def check_supported(self) -> None:
|
||||
try:
|
||||
subprocess.run( # nosec B603 B607
|
||||
["mkcert", "-help"],
|
||||
check=True,
|
||||
stderr=subprocess.DEVNULL,
|
||||
stdout=subprocess.DEVNULL,
|
||||
)
|
||||
except Exception as e:
|
||||
raise SanicException(
|
||||
"Sanic is attempting to use mkcert to generate local TLS "
|
||||
"certificates since you did not supply a certificate, but "
|
||||
"one is required. Sanic cannot proceed since mkcert does not "
|
||||
"appear to be installed. Alternatively, you can use trustme. "
|
||||
"Please install mkcert, trustme, or supply TLS certificates "
|
||||
"to proceed. Installation instructions can be found here: "
|
||||
"https://github.com/FiloSottile/mkcert.\n"
|
||||
"Find out more information about your options here: "
|
||||
"https://sanic.dev/en/guide/deployment/development.html#"
|
||||
"automatic-tls-certificate"
|
||||
) from e
|
||||
|
||||
def generate_cert(self, localhost: str) -> ssl.SSLContext:
|
||||
try:
|
||||
if not self.cert_path.exists():
|
||||
message = "Generating TLS certificate"
|
||||
# TODO: Validate input for security
|
||||
with loading(message):
|
||||
cmd = [
|
||||
"mkcert",
|
||||
"-key-file",
|
||||
str(self.key_path),
|
||||
"-cert-file",
|
||||
str(self.cert_path),
|
||||
localhost,
|
||||
]
|
||||
resp = subprocess.run( # nosec B603
|
||||
cmd,
|
||||
check=True,
|
||||
stdout=subprocess.PIPE,
|
||||
stderr=subprocess.STDOUT,
|
||||
text=True,
|
||||
)
|
||||
sys.stdout.write("\r" + " " * (len(message) + 4))
|
||||
sys.stdout.flush()
|
||||
sys.stdout.write(resp.stdout)
|
||||
finally:
|
||||
|
||||
@self.app.main_process_stop
|
||||
async def cleanup(*_): # no cov
|
||||
if self.tmpdir:
|
||||
with suppress(FileNotFoundError):
|
||||
self.key_path.unlink()
|
||||
self.cert_path.unlink()
|
||||
self.tmpdir.rmdir()
|
||||
|
||||
context = CertSimple(self.cert_path, self.key_path)
|
||||
context.sanic["creator"] = "mkcert"
|
||||
context.sanic["localhost"] = localhost
|
||||
SanicSSLContext.create_from_ssl_context(context)
|
||||
|
||||
return context
|
||||
|
||||
|
||||
class TrustmeCreator(CertCreator):
|
||||
def check_supported(self) -> None:
|
||||
if not TRUSTME_INSTALLED:
|
||||
raise SanicException(
|
||||
"Sanic is attempting to use trustme to generate local TLS "
|
||||
"certificates since you did not supply a certificate, but "
|
||||
"one is required. Sanic cannot proceed since trustme does not "
|
||||
"appear to be installed. Alternatively, you can use mkcert. "
|
||||
"Please install mkcert, trustme, or supply TLS certificates "
|
||||
"to proceed. Installation instructions can be found here: "
|
||||
"https://github.com/python-trio/trustme.\n"
|
||||
"Find out more information about your options here: "
|
||||
"https://sanic.dev/en/guide/deployment/development.html#"
|
||||
"automatic-tls-certificate"
|
||||
)
|
||||
|
||||
def generate_cert(self, localhost: str) -> ssl.SSLContext:
|
||||
context = SanicSSLContext.create_from_ssl_context(
|
||||
ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
|
||||
)
|
||||
context.sanic = {
|
||||
"cert": self.cert_path.absolute(),
|
||||
"key": self.key_path.absolute(),
|
||||
}
|
||||
ca = trustme.CA()
|
||||
server_cert = ca.issue_cert(localhost)
|
||||
server_cert.configure_cert(context)
|
||||
ca.configure_trust(context)
|
||||
|
||||
ca.cert_pem.write_to_path(str(self.cert_path.absolute()))
|
||||
server_cert.private_key_and_cert_chain_pem.write_to_path(
|
||||
str(self.key_path.absolute())
|
||||
)
|
||||
context.sanic["creator"] = "trustme"
|
||||
context.sanic["localhost"] = localhost
|
||||
|
||||
return context
|
||||
Reference in New Issue
Block a user