April 2013 - tor-commits - lists.torproject.org

[ooni-probe/master] Update docstring for SSLContextError.
by art＠torproject.org 30 Apr '13

30 Apr '13

commit ad8ac7d16263a964baec759ca4452eb21de73dd9 Author: Isis Lovecruft <isis(a)torproject.org> Date: Mon Apr 22 00:16:20 2013 +0000 Update docstring for SSLContextError. --- nettests/experimental/tls_handshake.py | 22 ++++++++++++++-------- 1 files changed, 14 insertions(+), 8 deletions(-) diff --git a/nettests/experimental/tls_handshake.py b/nettests/experimental/tls_handshake.py index a1e46ec..5d6d293 100644 --- a/nettests/experimental/tls_handshake.py +++ b/nettests/experimental/tls_handshake.py @@ -66,15 +66,21 @@ firefox_ciphers = ["ECDHE-ECDSA-AES256-SHA", "DHE-DSS-CAMELLIA128-SHA",] -class NoSSLContextError(Exception): - """ - Raised when we're missing the SSL context method, which should be one of - the following: +class SSLContextError(usage.UsageError): + """Raised when we're missing the SSL context method, or incompatible + contexts were provided. The SSL context method should be one of the + following: + + :attr:`OpenSSL.SSL.SSLv2_METHOD <OpenSSL.SSL.SSLv2_METHOD>` + :attr:`OpenSSL.SSL.SSLv23_METHOD <OpenSSL.SSL.SSLv23_METHOD>` + :attr:`OpenSSL.SSL.SSLv3_METHOD <OpenSSL.SSL.SSLv3_METHOD>` + :attr:`OpenSSL.SSL.TLSv1_METHOD <OpenSSL.SSL.TLSv1_METHOD>` + + To use the pre-defined error messages, construct with one of the + :meth:`SSLContextError.errors.keys <keys>` as the ``message`` string, like + so: - * :attr:`OpenSSL.SSL.SSLv2_METHOD` - * :attr:`OpenSSL.SSL.SSLv23_METHOD` - * :attr:`OpenSSL.SSL.SSLv3_METHOD` - * :attr:`OpenSSL.SSL.TLSv1_METHOD` + ``SSLContextError('NO_CONTEXT')`` """ pass

1 0

[ooni-probe/master] Create a host attribute for storing the --host option, and set self.ciphers.
by art＠torproject.org 30 Apr '13

30 Apr '13

commit 06b8f411d6d3bcfe45ea466827e0e12ac6dbac74 Author: Isis Lovecruft <isis(a)torproject.org> Date: Mon Apr 22 00:26:31 2013 +0000 Create a host attribute for storing the --host option, and set self.ciphers. * self.ciphers should exist even if we didn't recieve any localOptions from the runner. --- nettests/experimental/tls_handshake.py | 6 +++++- 1 files changed, 5 insertions(+), 1 deletions(-) diff --git a/nettests/experimental/tls_handshake.py b/nettests/experimental/tls_handshake.py index 92d9009..35955dc 100644 --- a/nettests/experimental/tls_handshake.py +++ b/nettests/experimental/tls_handshake.py @@ -138,9 +138,13 @@ class HandshakeTest(nettest.NetTestCase): context = SSL.Context(SSL.TLSv1_METHOD) def setUp(self, *args, **kwargs): + """Set defaults for a :class:`HandshakeTest <HandshakeTest>`.""" + + self.host = None + self.ciphers = list() + if self.localOptions: options = self.localOptions - self.ciphers = [] ## check that we're testing an IP:PORT, else exit gracefully: if not ((options['host'] and options['port']) or options['file']):

1 0

[ooni-probe/master] Bump the version number on HandshakeTest, and rename the usageOptions attribute.
by art＠torproject.org 30 Apr '13

30 Apr '13

commit c78574914e47ec13a8490a02fe34f98785aa4e4d Author: Isis Lovecruft <isis(a)torproject.org> Date: Mon Apr 22 00:23:57 2013 +0000 Bump the version number on HandshakeTest, and rename the usageOptions attribute. --- nettests/experimental/tls_handshake.py | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/nettests/experimental/tls_handshake.py b/nettests/experimental/tls_handshake.py index e834a3e..8aa7edf 100644 --- a/nettests/experimental/tls_handshake.py +++ b/nettests/experimental/tls_handshake.py @@ -127,10 +127,10 @@ class HandshakeTest(nettest.NetTestCase): name = 'tls-handshake' author = 'Isis Lovecruft <isis(a)torproject.org>' description = 'A test to determing if we can complete a TLS hankshake.' - version = '0.0.2' + version = '0.0.3' requiresRoot = False - usageOptions = UsageOptions + usageOptions = HandshakeOptions inputFile = ['file', 'f', None, 'List of <IP>:<PORT>s to test']

1 0

[ooni-probe/master] Remove UsageOptions to HandshakeOptions, and make arg help strings more informative.
by art＠torproject.org 30 Apr '13

30 Apr '13

commit c969c741049d78cdd8cdb5514a52d3411cb714ec Author: Isis Lovecruft <isis(a)torproject.org> Date: Mon Apr 22 00:22:00 2013 +0000 Remove UsageOptions to HandshakeOptions, and make arg help strings more informative. --- nettests/experimental/tls_handshake.py | 8 +++++--- 1 files changed, 5 insertions(+), 3 deletions(-) diff --git a/nettests/experimental/tls_handshake.py b/nettests/experimental/tls_handshake.py index 3ab9471..3b94504 100644 --- a/nettests/experimental/tls_handshake.py +++ b/nettests/experimental/tls_handshake.py @@ -106,11 +106,13 @@ class ConnectionTimeout(Exception): """ pass -class UsageOptions(usage.Options): +class HandshakeOptions(usage.Options): + """ :class:`usage.Options <Options>` parser for the tls-handshake test.""" optParameters = [ - ['host', 'h', None, 'Remote host IP address (v4/v6)'], + ['host', 'h', None, + 'Remote host IP address (v4/v6) and port, i.e. "1.2.3.4:443"'], ['port', 'p', None, - "Use this port for all hosts, regardless of port specified in file"], + 'Use this port for all hosts, regardless of port specified in file'], ['ciphersuite', 'c', None , 'File containing ciphersuite list, one per line'],] optFlags = [

1 0

[ooni-probe/master] Fix bug where conflicting SSL context choices was not explained to the user.
by art＠torproject.org 30 Apr '13

30 Apr '13

commit c89288d28281e17dee02400ab03d4e5b1f32864f Author: Isis Lovecruft <isis(a)torproject.org> Date: Mon Apr 22 00:35:17 2013 +0000 Fix bug where conflicting SSL context choices was not explained to the user. --- nettests/experimental/tls_handshake.py | 22 ++++++++++++++++------ 1 files changed, 16 insertions(+), 6 deletions(-) diff --git a/nettests/experimental/tls_handshake.py b/nettests/experimental/tls_handshake.py index 1ac3661..89a9bd9 100644 --- a/nettests/experimental/tls_handshake.py +++ b/nettests/experimental/tls_handshake.py @@ -152,13 +152,23 @@ class HandshakeTest(nettest.NetTestCase): if options['host']: self.host = options['host'] + ## If no context was chosen, explain our default to the user: + if not (options['ssl2'] or options['ssl3'] or options['tls1']): + try: raise SSLContextError('NO_CONTEXT') + except SSLContextError as sce: log.err(sce.message) else: - try: - raise NoSSLContextError( - "No SSL/TLS context chosen! Defaulting to TLSv1...") - except NoSSLContextError, ncse: - log.err(ncse.message) - self.context = SSL.Context(SSL.TLSv1_METHOD) + ## If incompatible contexts were chosen, inform the user: + if options['tls1'] and (options['ssl2'] or options['ssl3']): + try: raise SSLContextError('INCOMPATIBLE') + except SSLContextError as sce: log.err(sce.message) + finally: log.msg('Defaulting to testing only TLSv1.') + elif options['ssl2']: + if not options['ssl3']: + self.context = SSL.Context(SSL.SSLv2_METHOD) + else: + self.context = SSL.Context(SSL.SSLv23_METHOD) + elif options['ssl3']: + self.context = SSL.Context(SSL.SSLv3_METHOD) if not options['ciphersuite']: self.ciphers = firefox_ciphers

1 0

[ooni-probe/master] Make 'context' be a class-level attribute and give it a Sphinx :attr: docstring.
by art＠torproject.org 30 Apr '13

30 Apr '13

commit 3f51cbb8e267b2cf8a1a8e5d0267da03c80b2f72 Author: Isis Lovecruft <isis(a)torproject.org> Date: Mon Apr 22 00:25:11 2013 +0000 Make 'context' be a class-level attribute and give it a Sphinx :attr: docstring. --- nettests/experimental/tls_handshake.py | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) diff --git a/nettests/experimental/tls_handshake.py b/nettests/experimental/tls_handshake.py index 8aa7edf..92d9009 100644 --- a/nettests/experimental/tls_handshake.py +++ b/nettests/experimental/tls_handshake.py @@ -134,6 +134,9 @@ class HandshakeTest(nettest.NetTestCase): inputFile = ['file', 'f', None, 'List of <IP>:<PORT>s to test'] + #: Default SSL/TLS context method. + context = SSL.Context(SSL.TLSv1_METHOD) + def setUp(self, *args, **kwargs): if self.localOptions: options = self.localOptions

1 0

[ooni-probe/master] Add self.host to the inputProcessor().
by art＠torproject.org 30 Apr '13

30 Apr '13

commit 273ab4d9d723553fd6ee2fcd90762928dacfce8a Author: Isis Lovecruft <isis(a)torproject.org> Date: Mon Apr 22 00:44:56 2013 +0000 Add self.host to the inputProcessor(). --- nettests/experimental/tls_handshake.py | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) diff --git a/nettests/experimental/tls_handshake.py b/nettests/experimental/tls_handshake.py index eab721c..3585657 100644 --- a/nettests/experimental/tls_handshake.py +++ b/nettests/experimental/tls_handshake.py @@ -202,6 +202,8 @@ class HandshakeTest(nettest.NetTestCase): return (str(addr), int(port)) def inputProcessor(self, file=None): + if self.host: + yield self.splitInput(self.host) if os.path.isfile(file): with open(file) as fh: for line in fh.readlines():

1 0

[ooni-probe/master] Fix #8440, set the self.host attribute when given the --host option.
by art＠torproject.org 30 Apr '13

30 Apr '13

commit 044227d4f553ca4996a6c3e289c0df547025317b Author: Isis Lovecruft <isis(a)torproject.org> Date: Mon Apr 22 00:29:25 2013 +0000 Fix #8440, set the self.host attribute when given the --host option. * Port option doesn't need to be fixed. It does what the option help string always said it does (which is actually slightly confusing and perhaps should be changed): it sets *all* the hosts' ports to --port. So, given a file of host:ports and a '--host 1.2.3.4:4343' cmdline option, if also given '--port 443', it will check every host, both in the file and the cmdline directives, on port 443. This is useful for checking a specific port, like if we wanted to check TLSv1 on the IMAPS (993) port for every host. --- nettests/experimental/tls_handshake.py | 21 +++++---------------- 1 files changed, 5 insertions(+), 16 deletions(-) diff --git a/nettests/experimental/tls_handshake.py b/nettests/experimental/tls_handshake.py index 35955dc..1ac3661 100644 --- a/nettests/experimental/tls_handshake.py +++ b/nettests/experimental/tls_handshake.py @@ -147,22 +147,11 @@ class HandshakeTest(nettest.NetTestCase): options = self.localOptions ## check that we're testing an IP:PORT, else exit gracefully: - if not ((options['host'] and options['port']) or options['file']): - sys.exit("Need --host and --port, or --file!") + if not (options['host'] or options['file']): + raise SystemExit("Need --host or --file!") + if options['host']: + self.host = options['host'] - ## xxx TODO there's nothing that tells the user they can only have - ## one of the TLS/SSL methods at a time. - - ## set the SSL/TLS method to use: - if options['ssl2']: - if not options['ssl3']: - self.context = SSL.Context(SSL.SSLv2_METHOD) - else: - self.context = SSL.Context(SSL.SSLv23_METHOD) - elif options['ssl3']: - self.context = SSL.Context(SSL.SSLv3_METHOD) - elif options['tls1']: - self.context = SSL.Context(SSL.TLSv1_METHOD) else: try: raise NoSSLContextError(

1 0

[ooni-probe/master] Move to call IPAddress explicitly from ipaddr.IPAdress.
by art＠torproject.org 30 Apr '13

30 Apr '13

commit 6c2d8901d1bb099d026ddd820f0091a68a9b0b5c Author: Isis Lovecruft <isis(a)torproject.org> Date: Mon Apr 22 00:45:35 2013 +0000 Move to call IPAddress explicitly from ipaddr.IPAdress. --- nettests/experimental/tls_handshake.py | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/nettests/experimental/tls_handshake.py b/nettests/experimental/tls_handshake.py index 3585657..b715387 100644 --- a/nettests/experimental/tls_handshake.py +++ b/nettests/experimental/tls_handshake.py @@ -213,7 +213,7 @@ class HandshakeTest(nettest.NetTestCase): def buildSocket(self, addr): global s - ip = IPAddress(addr) ## learn if we're IPv4 or IPv6 + ip = ipaddr.IPAddress(addr) ## learn if we're IPv4 or IPv6 if ip.version == 4: s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) elif ip.version == 6:

1 0

[ooni-probe/master] Add Sphinx docstring for getPeerCert() function.
by art＠torproject.org 30 Apr '13

30 Apr '13

commit a550f38e1b79a924b3c6e636a3bf5464130b6382 Author: Isis Lovecruft <isis(a)torproject.org> Date: Mon Apr 22 00:46:42 2013 +0000 Add Sphinx docstring for getPeerCert() function. --- nettests/experimental/tls_handshake.py | 9 +++++++++ 1 files changed, 9 insertions(+), 0 deletions(-) diff --git a/nettests/experimental/tls_handshake.py b/nettests/experimental/tls_handshake.py index b715387..d2f58a3 100644 --- a/nettests/experimental/tls_handshake.py +++ b/nettests/experimental/tls_handshake.py @@ -226,6 +226,15 @@ class HandshakeTest(nettest.NetTestCase): @staticmethod def getPeerCert(connection, get_chain=False): + """Get the PEM-encoded certificate or cert chain of the remote host. + + :param connection: A :class:`OpenSSL.SSL.Connection <Connection>`. + :param bool get_chain: If True, get the all certificates in the + chain. Otherwise, only get the remote host's certificate. + :returns: A PEM-encoded x509 certificate. If + :param:`getPeerCert.get_chain <get_chain>` is True, returns a list + of PEM-encoded x509 certificates. + """ if not get_chain: x509_cert = connection.get_peer_certificate() pem_cert = crypto.dump_certificate(crypto.FILETYPE_PEM, x509_cert)

1 0