chore: rename project coven → hack-house ⛧
Rebrand the Rust client crate (coven/ → hh/, package+binary "hack-house"), README, CLI strings, and branch (coven → hack-house). Gitea repo renamed cmd-chat → hack-house to match. Crypto/server logic unchanged; selftest + golden-vector test still green, binary is now `hack-house`. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
leetcrypt
@@ -0,0 +1,5 @@
|
||||
from .context import process_to_context
|
||||
from .creators import get_ssl_context
|
||||
|
||||
|
||||
__all__ = ("get_ssl_context", "process_to_context")
|
||||
@@ -0,0 +1,210 @@
|
||||
from __future__ import annotations
|
||||
|
||||
import os
|
||||
import ssl
|
||||
|
||||
from collections.abc import Iterable
|
||||
from typing import Any
|
||||
|
||||
from sanic.log import logger
|
||||
|
||||
|
||||
# Only allow secure ciphers, notably leaving out AES-CBC mode
|
||||
# OpenSSL chooses ECDSA or RSA depending on the cert in use
|
||||
CIPHERS_TLS12 = [
|
||||
"ECDHE-ECDSA-CHACHA20-POLY1305",
|
||||
"ECDHE-ECDSA-AES256-GCM-SHA384",
|
||||
"ECDHE-ECDSA-AES128-GCM-SHA256",
|
||||
"ECDHE-RSA-CHACHA20-POLY1305",
|
||||
"ECDHE-RSA-AES256-GCM-SHA384",
|
||||
"ECDHE-RSA-AES128-GCM-SHA256",
|
||||
]
|
||||
|
||||
|
||||
def create_context(
|
||||
certfile: str | None = None,
|
||||
keyfile: str | None = None,
|
||||
password: str | None = None,
|
||||
purpose: ssl.Purpose = ssl.Purpose.CLIENT_AUTH,
|
||||
) -> ssl.SSLContext:
|
||||
"""Create a context with secure crypto and HTTP/1.1 in protocols."""
|
||||
context = ssl.create_default_context(purpose=purpose)
|
||||
context.minimum_version = ssl.TLSVersion.TLSv1_2
|
||||
context.set_ciphers(":".join(CIPHERS_TLS12))
|
||||
context.set_alpn_protocols(["http/1.1"])
|
||||
if purpose is ssl.Purpose.CLIENT_AUTH:
|
||||
context.sni_callback = server_name_callback
|
||||
if certfile and keyfile:
|
||||
context.load_cert_chain(certfile, keyfile, password)
|
||||
return context
|
||||
|
||||
|
||||
def shorthand_to_ctx(
|
||||
ctxdef: None | ssl.SSLContext | dict | str,
|
||||
) -> ssl.SSLContext | None:
|
||||
"""Convert an ssl argument shorthand to an SSLContext object."""
|
||||
if ctxdef is None or isinstance(ctxdef, ssl.SSLContext):
|
||||
return ctxdef
|
||||
if isinstance(ctxdef, str):
|
||||
return load_cert_dir(ctxdef)
|
||||
if isinstance(ctxdef, dict):
|
||||
return CertSimple(**ctxdef)
|
||||
raise ValueError(
|
||||
f"Invalid ssl argument {type(ctxdef)}."
|
||||
" Expecting a list of certdirs, a dict or an SSLContext."
|
||||
)
|
||||
|
||||
|
||||
def process_to_context(
|
||||
ssldef: None | ssl.SSLContext | dict | str | list | tuple,
|
||||
) -> ssl.SSLContext | None:
|
||||
"""Process app.run ssl argument from easy formats to full SSLContext."""
|
||||
return (
|
||||
CertSelector(map(shorthand_to_ctx, ssldef))
|
||||
if isinstance(ssldef, (list, tuple))
|
||||
else shorthand_to_ctx(ssldef)
|
||||
)
|
||||
|
||||
|
||||
def load_cert_dir(p: str) -> ssl.SSLContext:
|
||||
if os.path.isfile(p):
|
||||
raise ValueError(f"Certificate folder expected but {p} is a file.")
|
||||
keyfile = os.path.join(p, "privkey.pem")
|
||||
certfile = os.path.join(p, "fullchain.pem")
|
||||
if not os.access(keyfile, os.R_OK):
|
||||
raise ValueError(
|
||||
f"Certificate not found or permission denied {keyfile}"
|
||||
)
|
||||
if not os.access(certfile, os.R_OK):
|
||||
raise ValueError(
|
||||
f"Certificate not found or permission denied {certfile}"
|
||||
)
|
||||
return CertSimple(certfile, keyfile)
|
||||
|
||||
|
||||
def find_cert(self: CertSelector, server_name: str):
|
||||
"""Find the first certificate that matches the given SNI.
|
||||
|
||||
:raises ssl.CertificateError: No matching certificate found.
|
||||
:return: A matching ssl.SSLContext object if found."""
|
||||
if not server_name:
|
||||
if self.sanic_fallback:
|
||||
return self.sanic_fallback
|
||||
raise ValueError(
|
||||
"The client provided no SNI to match for certificate."
|
||||
)
|
||||
for ctx in self.sanic_select:
|
||||
if match_hostname(ctx, server_name):
|
||||
return ctx
|
||||
if self.sanic_fallback:
|
||||
return self.sanic_fallback
|
||||
raise ValueError(f"No certificate found matching hostname {server_name!r}")
|
||||
|
||||
|
||||
def match_hostname(ctx: ssl.SSLContext | CertSelector, hostname: str) -> bool:
|
||||
"""Match names from CertSelector against a received hostname."""
|
||||
# Local certs are considered trusted, so this can be less pedantic
|
||||
# and thus faster than the deprecated ssl.match_hostname function is.
|
||||
names = dict(getattr(ctx, "sanic", {})).get("names", [])
|
||||
hostname = hostname.lower()
|
||||
for name in names:
|
||||
if name.startswith("*."):
|
||||
if hostname.split(".", 1)[-1] == name[2:]:
|
||||
return True
|
||||
elif name == hostname:
|
||||
return True
|
||||
return False
|
||||
|
||||
|
||||
def selector_sni_callback(
|
||||
sslobj: ssl.SSLObject, server_name: str, ctx: CertSelector
|
||||
) -> int | None:
|
||||
"""Select a certificate matching the SNI."""
|
||||
# Call server_name_callback to store the SNI on sslobj
|
||||
server_name_callback(sslobj, server_name, ctx)
|
||||
# Find a new context matching the hostname
|
||||
try:
|
||||
sslobj.context = find_cert(ctx, server_name)
|
||||
except ValueError as e:
|
||||
logger.warning(f"Rejecting TLS connection: {e}")
|
||||
# This would show ERR_SSL_UNRECOGNIZED_NAME_ALERT on client side if
|
||||
# asyncio/uvloop did proper SSL shutdown. They don't.
|
||||
return ssl.ALERT_DESCRIPTION_UNRECOGNIZED_NAME
|
||||
return None # mypy complains without explicit return
|
||||
|
||||
|
||||
def server_name_callback(
|
||||
sslobj: ssl.SSLObject, server_name: str, ctx: ssl.SSLContext
|
||||
) -> None:
|
||||
"""Store the received SNI as sslobj.sanic_server_name."""
|
||||
sslobj.sanic_server_name = server_name # type: ignore
|
||||
|
||||
|
||||
class SanicSSLContext(ssl.SSLContext):
|
||||
sanic: dict[str, os.PathLike]
|
||||
|
||||
@classmethod
|
||||
def create_from_ssl_context(cls, context: ssl.SSLContext):
|
||||
context.__class__ = cls
|
||||
return context
|
||||
|
||||
|
||||
class CertSimple(SanicSSLContext):
|
||||
"""A wrapper for creating SSLContext with a sanic attribute."""
|
||||
|
||||
sanic: dict[str, Any]
|
||||
|
||||
def __new__(cls, cert, key, **kw):
|
||||
# try common aliases, rename to cert/key
|
||||
certfile = kw["cert"] = kw.pop("certificate", None) or cert
|
||||
keyfile = kw["key"] = kw.pop("keyfile", None) or key
|
||||
password = kw.get("password", None)
|
||||
if not certfile or not keyfile:
|
||||
raise ValueError("SSL dict needs filenames for cert and key.")
|
||||
subject = {}
|
||||
if "names" not in kw:
|
||||
cert = ssl._ssl._test_decode_cert(certfile) # type: ignore
|
||||
kw["names"] = [
|
||||
name
|
||||
for t, name in cert["subjectAltName"]
|
||||
if t in ["DNS", "IP Address"]
|
||||
]
|
||||
subject = {k: v for item in cert["subject"] for k, v in item}
|
||||
self = create_context(certfile, keyfile, password)
|
||||
self.__class__ = cls
|
||||
self.sanic = {**subject, **kw}
|
||||
return self
|
||||
|
||||
def __init__(self, cert, key, **kw):
|
||||
pass # Do not call super().__init__ because it is already initialized
|
||||
|
||||
|
||||
class CertSelector(ssl.SSLContext):
|
||||
"""Automatically select SSL certificate based on the hostname that the
|
||||
client is trying to access, via SSL SNI. Paths to certificate folders
|
||||
with privkey.pem and fullchain.pem in them should be provided, and
|
||||
will be matched in the order given whenever there is a new connection.
|
||||
"""
|
||||
|
||||
def __new__(cls, ctxs):
|
||||
return super().__new__(cls)
|
||||
|
||||
def __init__(self, ctxs: Iterable[ssl.SSLContext | None]):
|
||||
super().__init__()
|
||||
self.sni_callback = selector_sni_callback # type: ignore
|
||||
self.sanic_select = []
|
||||
self.sanic_fallback = None
|
||||
all_names = []
|
||||
for i, ctx in enumerate(ctxs):
|
||||
if not ctx:
|
||||
continue
|
||||
names = dict(getattr(ctx, "sanic", {})).get("names", [])
|
||||
all_names += names
|
||||
self.sanic_select.append(ctx)
|
||||
if i == 0:
|
||||
self.sanic_fallback = ctx
|
||||
if not all_names:
|
||||
raise ValueError(
|
||||
"No certificates with SubjectAlternativeNames found."
|
||||
)
|
||||
logger.info(f"Certificate vhosts: {', '.join(all_names)}")
|
||||
@@ -0,0 +1,287 @@
|
||||
from __future__ import annotations
|
||||
|
||||
import ssl
|
||||
import subprocess
|
||||
import sys
|
||||
|
||||
from abc import ABC, abstractmethod
|
||||
from contextlib import suppress
|
||||
from pathlib import Path
|
||||
from tempfile import mkdtemp
|
||||
from types import ModuleType
|
||||
from typing import TYPE_CHECKING, cast
|
||||
|
||||
from sanic.application.constants import Mode
|
||||
from sanic.application.spinner import loading
|
||||
from sanic.constants import (
|
||||
DEFAULT_LOCAL_TLS_CERT,
|
||||
DEFAULT_LOCAL_TLS_KEY,
|
||||
LocalCertCreator,
|
||||
)
|
||||
from sanic.exceptions import SanicException
|
||||
from sanic.helpers import Default
|
||||
from sanic.http.tls.context import CertSimple, SanicSSLContext
|
||||
|
||||
|
||||
try:
|
||||
import trustme
|
||||
|
||||
TRUSTME_INSTALLED = True
|
||||
except (ImportError, ModuleNotFoundError):
|
||||
trustme = ModuleType("trustme")
|
||||
TRUSTME_INSTALLED = False
|
||||
|
||||
if TYPE_CHECKING:
|
||||
from sanic import Sanic
|
||||
|
||||
|
||||
# Only allow secure ciphers, notably leaving out AES-CBC mode
|
||||
# OpenSSL chooses ECDSA or RSA depending on the cert in use
|
||||
CIPHERS_TLS12 = [
|
||||
"ECDHE-ECDSA-CHACHA20-POLY1305",
|
||||
"ECDHE-ECDSA-AES256-GCM-SHA384",
|
||||
"ECDHE-ECDSA-AES128-GCM-SHA256",
|
||||
"ECDHE-RSA-CHACHA20-POLY1305",
|
||||
"ECDHE-RSA-AES256-GCM-SHA384",
|
||||
"ECDHE-RSA-AES128-GCM-SHA256",
|
||||
]
|
||||
|
||||
|
||||
def _make_path(maybe_path: Path | str, tmpdir: Path | None) -> Path:
|
||||
if isinstance(maybe_path, Path):
|
||||
return maybe_path
|
||||
else:
|
||||
path = Path(maybe_path)
|
||||
if not path.exists():
|
||||
if not tmpdir:
|
||||
raise RuntimeError("Reached an unknown state. No tmpdir.")
|
||||
return tmpdir / maybe_path
|
||||
|
||||
return path
|
||||
|
||||
|
||||
def get_ssl_context(app: Sanic, ssl: ssl.SSLContext | None) -> ssl.SSLContext:
|
||||
if ssl:
|
||||
return ssl
|
||||
|
||||
if app.state.mode is Mode.PRODUCTION:
|
||||
raise SanicException(
|
||||
"Cannot run Sanic as an HTTPS server in PRODUCTION mode "
|
||||
"without passing a TLS certificate. If you are developing "
|
||||
"locally, please enable DEVELOPMENT mode and Sanic will "
|
||||
"generate a localhost TLS certificate. For more information "
|
||||
"please see: https://sanic.dev/en/guide/deployment/development."
|
||||
"html#automatic-tls-certificate."
|
||||
)
|
||||
|
||||
creator = CertCreator.select(
|
||||
app,
|
||||
cast(LocalCertCreator, app.config.LOCAL_CERT_CREATOR),
|
||||
app.config.LOCAL_TLS_KEY,
|
||||
app.config.LOCAL_TLS_CERT,
|
||||
)
|
||||
context = creator.generate_cert(app.config.LOCALHOST)
|
||||
return context
|
||||
|
||||
|
||||
class CertCreator(ABC):
|
||||
def __init__(self, app, key, cert) -> None:
|
||||
self.app = app
|
||||
self.key = key
|
||||
self.cert = cert
|
||||
self.tmpdir = None
|
||||
|
||||
if isinstance(self.key, Default) or isinstance(self.cert, Default):
|
||||
self.tmpdir = Path(mkdtemp())
|
||||
|
||||
key = (
|
||||
DEFAULT_LOCAL_TLS_KEY
|
||||
if isinstance(self.key, Default)
|
||||
else self.key
|
||||
)
|
||||
cert = (
|
||||
DEFAULT_LOCAL_TLS_CERT
|
||||
if isinstance(self.cert, Default)
|
||||
else self.cert
|
||||
)
|
||||
|
||||
self.key_path = _make_path(key, self.tmpdir)
|
||||
self.cert_path = _make_path(cert, self.tmpdir)
|
||||
|
||||
@abstractmethod
|
||||
def check_supported(self) -> None: # no cov
|
||||
...
|
||||
|
||||
@abstractmethod
|
||||
def generate_cert(self, localhost: str) -> ssl.SSLContext: # no cov
|
||||
...
|
||||
|
||||
@classmethod
|
||||
def select(
|
||||
cls,
|
||||
app: Sanic,
|
||||
cert_creator: LocalCertCreator,
|
||||
local_tls_key,
|
||||
local_tls_cert,
|
||||
) -> CertCreator:
|
||||
creator: CertCreator | None = None
|
||||
|
||||
cert_creator_options: tuple[
|
||||
tuple[type[CertCreator], LocalCertCreator], ...
|
||||
] = (
|
||||
(MkcertCreator, LocalCertCreator.MKCERT),
|
||||
(TrustmeCreator, LocalCertCreator.TRUSTME),
|
||||
)
|
||||
for creator_class, local_creator in cert_creator_options:
|
||||
creator = cls._try_select(
|
||||
app,
|
||||
creator,
|
||||
creator_class,
|
||||
local_creator,
|
||||
cert_creator,
|
||||
local_tls_key,
|
||||
local_tls_cert,
|
||||
)
|
||||
if creator:
|
||||
break
|
||||
|
||||
if not creator:
|
||||
raise SanicException(
|
||||
"Sanic could not find package to create a TLS certificate. "
|
||||
"You must have either mkcert or trustme installed. See "
|
||||
"https://sanic.dev/en/guide/deployment/development.html"
|
||||
"#automatic-tls-certificate for more details."
|
||||
)
|
||||
|
||||
return creator
|
||||
|
||||
@staticmethod
|
||||
def _try_select(
|
||||
app: Sanic,
|
||||
creator: CertCreator | None,
|
||||
creator_class: type[CertCreator],
|
||||
creator_requirement: LocalCertCreator,
|
||||
creator_requested: LocalCertCreator,
|
||||
local_tls_key,
|
||||
local_tls_cert,
|
||||
):
|
||||
if creator or (
|
||||
creator_requested is not LocalCertCreator.AUTO
|
||||
and creator_requested is not creator_requirement
|
||||
):
|
||||
return creator
|
||||
|
||||
instance = creator_class(app, local_tls_key, local_tls_cert)
|
||||
try:
|
||||
instance.check_supported()
|
||||
except SanicException:
|
||||
if creator_requested is creator_requirement:
|
||||
raise
|
||||
else:
|
||||
return None
|
||||
|
||||
return instance
|
||||
|
||||
|
||||
class MkcertCreator(CertCreator):
|
||||
def check_supported(self) -> None:
|
||||
try:
|
||||
subprocess.run( # nosec B603 B607
|
||||
["mkcert", "-help"],
|
||||
check=True,
|
||||
stderr=subprocess.DEVNULL,
|
||||
stdout=subprocess.DEVNULL,
|
||||
)
|
||||
except Exception as e:
|
||||
raise SanicException(
|
||||
"Sanic is attempting to use mkcert to generate local TLS "
|
||||
"certificates since you did not supply a certificate, but "
|
||||
"one is required. Sanic cannot proceed since mkcert does not "
|
||||
"appear to be installed. Alternatively, you can use trustme. "
|
||||
"Please install mkcert, trustme, or supply TLS certificates "
|
||||
"to proceed. Installation instructions can be found here: "
|
||||
"https://github.com/FiloSottile/mkcert.\n"
|
||||
"Find out more information about your options here: "
|
||||
"https://sanic.dev/en/guide/deployment/development.html#"
|
||||
"automatic-tls-certificate"
|
||||
) from e
|
||||
|
||||
def generate_cert(self, localhost: str) -> ssl.SSLContext:
|
||||
try:
|
||||
if not self.cert_path.exists():
|
||||
message = "Generating TLS certificate"
|
||||
# TODO: Validate input for security
|
||||
with loading(message):
|
||||
cmd = [
|
||||
"mkcert",
|
||||
"-key-file",
|
||||
str(self.key_path),
|
||||
"-cert-file",
|
||||
str(self.cert_path),
|
||||
localhost,
|
||||
]
|
||||
resp = subprocess.run( # nosec B603
|
||||
cmd,
|
||||
check=True,
|
||||
stdout=subprocess.PIPE,
|
||||
stderr=subprocess.STDOUT,
|
||||
text=True,
|
||||
)
|
||||
sys.stdout.write("\r" + " " * (len(message) + 4))
|
||||
sys.stdout.flush()
|
||||
sys.stdout.write(resp.stdout)
|
||||
finally:
|
||||
|
||||
@self.app.main_process_stop
|
||||
async def cleanup(*_): # no cov
|
||||
if self.tmpdir:
|
||||
with suppress(FileNotFoundError):
|
||||
self.key_path.unlink()
|
||||
self.cert_path.unlink()
|
||||
self.tmpdir.rmdir()
|
||||
|
||||
context = CertSimple(self.cert_path, self.key_path)
|
||||
context.sanic["creator"] = "mkcert"
|
||||
context.sanic["localhost"] = localhost
|
||||
SanicSSLContext.create_from_ssl_context(context)
|
||||
|
||||
return context
|
||||
|
||||
|
||||
class TrustmeCreator(CertCreator):
|
||||
def check_supported(self) -> None:
|
||||
if not TRUSTME_INSTALLED:
|
||||
raise SanicException(
|
||||
"Sanic is attempting to use trustme to generate local TLS "
|
||||
"certificates since you did not supply a certificate, but "
|
||||
"one is required. Sanic cannot proceed since trustme does not "
|
||||
"appear to be installed. Alternatively, you can use mkcert. "
|
||||
"Please install mkcert, trustme, or supply TLS certificates "
|
||||
"to proceed. Installation instructions can be found here: "
|
||||
"https://github.com/python-trio/trustme.\n"
|
||||
"Find out more information about your options here: "
|
||||
"https://sanic.dev/en/guide/deployment/development.html#"
|
||||
"automatic-tls-certificate"
|
||||
)
|
||||
|
||||
def generate_cert(self, localhost: str) -> ssl.SSLContext:
|
||||
context = SanicSSLContext.create_from_ssl_context(
|
||||
ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
|
||||
)
|
||||
context.sanic = {
|
||||
"cert": self.cert_path.absolute(),
|
||||
"key": self.key_path.absolute(),
|
||||
}
|
||||
ca = trustme.CA()
|
||||
server_cert = ca.issue_cert(localhost)
|
||||
server_cert.configure_cert(context)
|
||||
ca.configure_trust(context)
|
||||
|
||||
ca.cert_pem.write_to_path(str(self.cert_path.absolute()))
|
||||
server_cert.private_key_and_cert_chain_pem.write_to_path(
|
||||
str(self.key_path.absolute())
|
||||
)
|
||||
context.sanic["creator"] = "trustme"
|
||||
context.sanic["localhost"] = localhost
|
||||
|
||||
return context
|
||||
Reference in New Issue
Block a user