Skip to content

Commit eeafb6a

Browse files
sigmavirus24sigmavirus24
authored
Merge pull request #6662 from sigmavirus24/fix-tls-floppy
Add local TLS server
2 parents a58d7f2 + a94e9b5 commit eeafb6a

30 files changed

Lines changed: 716 additions & 9 deletions

‎src/requests/adapters.py‎

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,9 @@ def SOCKSProxyManager(*args, **kwargs):
7373

7474

7575
def _urllib3_request_context(
76-
request: "PreparedRequest", verify: "bool | str | None"
76+
request: "PreparedRequest",
77+
verify: "bool | str | None",
78+
client_cert: "typing.Tuple[str, str] | str | None",
7779
) -> "(typing.Dict[str, typing.Any], typing.Dict[str, typing.Any])":
7880
host_params = {}
7981
pool_kwargs = {}
@@ -86,6 +88,14 @@ def _urllib3_request_context(
8688
if isinstance(verify, str):
8789
pool_kwargs["ca_certs"] = verify
8890
pool_kwargs["cert_reqs"] = cert_reqs
91+
if client_cert is not None:
92+
if isinstance(client_cert, tuple) and len(client_cert) == 2:
93+
pool_kwargs["cert_file"] = client_cert[0]
94+
pool_kwargs["key_file"] = client_cert[1]
95+
else:
96+
# According to our docs, we allow users to specify just the client
97+
# cert path
98+
pool_kwargs["cert_file"] = client_cert
8999
host_params = {
90100
"scheme": scheme,
91101
"host": parsed_request_url.hostname,
@@ -354,13 +364,13 @@ def build_response(self, req, resp):
354364

355365
return response
356366

357-
def _get_connection(self, request, verify, proxies=None):
367+
def _get_connection(self, request, verify, proxies=None, cert=None):
358368
# Replace the existing get_connection without breaking things and
359369
# ensure that TLS settings are considered when we interact with
360370
# urllib3 HTTP Pools
361371
proxy = select_proxy(request.url, proxies)
362372
try:
363-
host_params, pool_kwargs = _urllib3_request_context(request, verify)
373+
host_params, pool_kwargs = _urllib3_request_context(request, verify, cert)
364374
except ValueError as e:
365375
raise InvalidURL(e, request=request)
366376
if proxy:
@@ -509,7 +519,7 @@ def send(
509519
"""
510520

511521
try:
512-
conn = self._get_connection(request, verify, proxies)
522+
conn = self._get_connection(request, verify, proxies=proxies, cert=cert)
513523
except LocationValueError as e:
514524
raise InvalidURL(e, request=request)
515525

‎tests/certs/README.md‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
# Testing Certificates
2+
3+
This is a collection of certificates useful for testing aspects of Requests'
4+
behaviour.
5+
6+
The certificates include:
7+
8+
* [expired](./expired) server certificate with a valid certificate authority
9+
* [mtls](./mtls) provides a valid client certificate with a 2 year validity
10+
* [valid](./valid) has a valid server certificate

‎tests/certs/expired/Makefile‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
.PHONY: all clean ca server
2+
3+
ca:
4+
make -C $@ all
5+
6+
server:
7+
make -C $@ all
8+
9+
all: ca server
10+
11+
clean:
12+
make -C ca clean
13+
make -C server clean

‎tests/certs/expired/README.md‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# Expired Certificates and Configuration for Testing
2+
3+
This has a valid certificate authority in [ca](./ca) and an invalid server
4+
certificate in [server](./server).
5+
6+
This can all be regenerated with:
7+
8+
```
9+
make clean
10+
make all
11+
```

‎tests/certs/expired/ca/Makefile‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
.PHONY: all clean
2+
3+
root_files = ca-private.key ca.crt
4+
5+
ca-private.key:
6+
openssl genrsa -out ca-private.key 2048
7+
8+
all: ca-private.key
9+
openssl req -x509 -sha256 -days 7300 -key ca-private.key -out ca.crt -config ca.cnf
10+
ln -s ca.crt cacert.pem
11+
12+
clean:
13+
rm -f cacert.pem ca.crt ca-private.key *.csr

‎tests/certs/expired/ca/ca-private.key‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
-----BEGIN PRIVATE KEY-----
2+
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDHlIhe7GLCeSk8
3+
RZOKdtmyKns6KdZgGw/LcxPkYvQlu1g0zV8X0DqVr2LdMumWUTNCc9sPdSlAG+He
4+
mQp2TMoWUMumMuwDtit9RT0Sb6Eh9svWgjY9ferovPJRfCWUTsA2Ug8uoh0wyEXK
5+
na7X6fHt5E3B9vj0+b9a4vDibdBXV11FheLT02/uEmAEJDdP/zeBgvVbhcVyumO6
6+
fAGMIWzR2ukhe8z/ma5H9zoi4gZA8nsK6reZUD8+6affnPe+jIt/AdzggtV9jkWm
7+
zSpr+RHeZ0y+q4eik2ZNUGg4XcF6JsJ9yu/AqLBXxd38uLdFfgyhP2y6K628yzgy
8+
e6lzFyWnAgMBAAECggEAFwzHhzcD3PQDWCus85PwZoxTeQ817BmUBGpBBOKM0gLG
9+
GCsT7XsmGP2NjICBy9OK+QTKawmb/wR5XK0OMUWDHXqtWn+NFIyojyo8+HEeCf8n
10+
4ZleTFHLnJ+d2N1etbc2qc9mY3tjpaurq8/0Tol9YH06ock1TY2+lO+a5HvMURnY
11+
hcWs70CamL+5B/6n67DhjzMtIW3dIXuEEceM1BW/jW8SKq0JHpQ3t+OJwID7zFaJ
12+
bLyOwAVheMzVGvN3yphf8tll3tMA65bNjdOzgOfZSjAy7EGjW3DyAolDw9jKLRyu
13+
E0gw/exNGe618oMIeUDv0KParlL4RjdiUP8l0xYOwQKBgQD3eYj9rWeqZquI9vKP
14+
gaSv6urb2UJLngShZUpEZRNJgBO+Ewiof0w8tpQdsnuMvWudxMLbzgiUNA+NyC/K
15+
CpzIXFkWnWx+A/pxs8ZO8moOfajVRayJgeOLsQZb7c4fXGsVGApbN4+cPNhTNG6d
16+
ucErv6tae/SzAzcLc5Vkw/ELxwKBgQDOdJ5Wl5JeKAvU/3kF6+MYWCrXxZqMjoHS
17+
y1BtyMX5RbdaWTCfDUu1aV3qJOJjjWQ9DJdJQcEsrTjOpD4bVdZx4w/XEG0JXAa3
18+
jRypVHGdeG/TjhUGJA8U+KX3a1DkcdqM9pqFYRw5Ie95Wz9YRroI+YkixqpK8d7W
19+
C+5BodxXIQKBgCk8Lv9V7XgPM3XW8APJbk+BrTCEuu8unUbnQcCztssAdEmvkjnB
20+
PErBgVyRaNTCmzPmnTFS20sWgaD2QkBAFG+uM4n5ISK+NvTLJ7fv3IwdlAw1V9Jx
21+
uiCElrKqpTXEiHMzVkZss5ks6j6y9duCIBXSEhM5pERPvNRDphjsLTXxAoGARSNC
22+
nyb1Kjjo9XR0V+pNy6pC9q1C+00B5tCVZ55zxe114Hi70pfGQcM+YxnlAoeoCNW9
23+
mBfAFDESNAlGjyrovIzYkiH7EcZSrYdBEOepgJ2DfWo4Wi0bK9+03K2AknAaS1iO
24+
GJqTtAJMSuymwu40gKroJNA42Q40nKO0LyCARGECgYEAiFRHkblBtStv22SpZxNC
25+
jim9yuM0ikh7Ij1lEHysc/GWb2RQNxQVk54BU2kQ0d9xwMZQTKvpF3VE9t7uGdwt
26+
AasWPr/tWYt35Ud0D4bNlagJJ4Xdslf8n1nkq3qqqDQbd7kkQRgwGzVr0uVg7ZfS
27+
26qSPQ0/aF9nagb5eHX3AuU=
28+
-----END PRIVATE KEY-----

‎tests/certs/expired/ca/ca.cnf‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
[req]
2+
default_bits = 2048
3+
prompt = no
4+
default_md = sha256
5+
encrypt_key = no
6+
distinguished_name = dn
7+
8+
[dn]
9+
C = US # country code
10+
O = Python Software Foundation # organization
11+
OU = python-requests # organization unit/department
12+
CN = Self-Signed Root CA # common name / your cert name

‎tests/certs/expired/ca/ca.crt‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIDWzCCAkMCFA9wdtNh/V99DRwYp8vXjPxSjJnWMA0GCSqGSIb3DQEBCwUAMGox
3+
CzAJBgNVBAYTAlVTMSMwIQYDVQQKDBpQeXRob24gU29mdHdhcmUgRm91bmRhdGlv
4+
bjEYMBYGA1UECwwPcHl0aG9uLXJlcXVlc3RzMRwwGgYDVQQDDBNTZWxmLVNpZ25l
5+
ZCBSb290IENBMB4XDTI0MDMxMjIxMDQwM1oXDTQ0MDMwNzIxMDQwM1owajELMAkG
6+
A1UEBhMCVVMxIzAhBgNVBAoMGlB5dGhvbiBTb2Z0d2FyZSBGb3VuZGF0aW9uMRgw
7+
FgYDVQQLDA9weXRob24tcmVxdWVzdHMxHDAaBgNVBAMME1NlbGYtU2lnbmVkIFJv
8+
b3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHlIhe7GLCeSk8
9+
RZOKdtmyKns6KdZgGw/LcxPkYvQlu1g0zV8X0DqVr2LdMumWUTNCc9sPdSlAG+He
10+
mQp2TMoWUMumMuwDtit9RT0Sb6Eh9svWgjY9ferovPJRfCWUTsA2Ug8uoh0wyEXK
11+
na7X6fHt5E3B9vj0+b9a4vDibdBXV11FheLT02/uEmAEJDdP/zeBgvVbhcVyumO6
12+
fAGMIWzR2ukhe8z/ma5H9zoi4gZA8nsK6reZUD8+6affnPe+jIt/AdzggtV9jkWm
13+
zSpr+RHeZ0y+q4eik2ZNUGg4XcF6JsJ9yu/AqLBXxd38uLdFfgyhP2y6K628yzgy
14+
e6lzFyWnAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAGymNVTsKSAq8Ju6zV+AWAyV
15+
GcUNBmLpgzDA0e7pkVYhHTdWKlGH4GnrRcp0nvnSbr6iq1Ob/8yEUUoRzK55Flws
16+
Kt1OLwnZyhfRoSUesoEqpP68vzWEgiYv0QuIWvzNt0YfAAvEgGoc3iri44MelKLn
17+
9ZMT8m91nVamA35R8ZjfeAkNp2xcz0a67V0ww6o4wSXrG7o5ZRXyjqZ/9K7SfwUJ
18+
rV9RciccsjH/MzKbfrx73QwsbPWiFmjzHopdasIO0lDlmgm/r9gKfkbzfKoGCgLZ
19+
6an6FlmLftLSXijf/QwtqeSP9fODeE3dzBmnTM3jdoVS53ZegUDWNl14o25v2Kg=
20+
-----END CERTIFICATE-----

‎tests/certs/expired/ca/ca.srl‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
4F36C3A7E075BA6452D10EEB81E7F189FF489B74

‎tests/certs/expired/server/Makefile‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
.PHONY: all clean
2+
3+
server.key:
4+
openssl genrsa -out $@ 2048
5+
6+
server.csr: server.key
7+
openssl req -key $< -new -out $@ -config cert.cnf
8+
9+
server.pem: server.csr
10+
openssl x509 -req -CA ../ca/ca.crt -CAkey ../ca/ca-private.key -in server.csr -outform PEM -out server.pem -days 0 -CAcreateserial
11+
openssl x509 -in ../ca/ca.crt -outform PEM >> $@
12+
13+
all: server.pem
14+
15+
clean:
16+
rm -f server.*

0 commit comments

Comments
 (0)