1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
|
# Copyright 2013 IBM Corp.
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
import copy
import os
import ssl
from oslo_service._i18n import _
from oslo_service import _options
from debtcollector import removals
removals.removed_module(
__name__,
replacement=None,
removal_version="2026.2",
message=(
"The 'oslo_service.sslutils' module is deprecated and will be removed"
" in version 2026.2."
)
)
config_section = 'ssl'
_SSL_PROTOCOLS = {
"tlsv1": ssl.PROTOCOL_TLSv1,
"sslv23": ssl.PROTOCOL_SSLv23
}
_OPTIONAL_PROTOCOLS = {
'sslv2': 'PROTOCOL_SSLv2',
'sslv3': 'PROTOCOL_SSLv3',
'tlsv1_1': 'PROTOCOL_TLSv1_1',
'tlsv1_2': 'PROTOCOL_TLSv1_2',
}
for protocol in _OPTIONAL_PROTOCOLS:
try:
_SSL_PROTOCOLS[protocol] = getattr(ssl,
_OPTIONAL_PROTOCOLS[protocol])
except AttributeError: # nosec
pass
def list_opts():
"""Entry point for oslo-config-generator."""
return [(config_section, copy.deepcopy(_options.ssl_opts))]
def register_opts(conf):
"""Registers sslutils config options."""
return conf.register_opts(_options.ssl_opts, config_section)
def is_enabled(conf):
conf.register_opts(_options.ssl_opts, config_section)
cert_file = conf.ssl.cert_file
key_file = conf.ssl.key_file
ca_file = conf.ssl.ca_file
use_ssl = cert_file or key_file
if cert_file and not os.path.exists(cert_file):
raise RuntimeError(_("Unable to find cert_file : %s") % cert_file)
if ca_file and not os.path.exists(ca_file):
raise RuntimeError(_("Unable to find ca_file : %s") % ca_file)
if key_file and not os.path.exists(key_file):
raise RuntimeError(_("Unable to find key_file : %s") % key_file)
if use_ssl and (not cert_file or not key_file):
raise RuntimeError(_("When running server in SSL mode, you must "
"specify both a cert_file and key_file "
"option value in your configuration file"))
return use_ssl
def wrap(conf, sock):
conf.register_opts(_options.ssl_opts, config_section)
ssl_version = ssl.PROTOCOL_TLS_SERVER
if conf.ssl.version:
key = conf.ssl.version.lower()
try:
ssl_version = _SSL_PROTOCOLS[key]
except KeyError:
raise RuntimeError(
_("Invalid SSL version : %s") % conf.ssl.version)
context = ssl.SSLContext(ssl_version)
context.load_cert_chain(conf.ssl.cert_file, conf.ssl.key_file)
if conf.ssl.ca_file:
context.verify_mode = ssl.CERT_REQUIRED
context.load_verify_locations(conf.ssl.ca_file)
else:
context.check_hostname = False
context.verify_mode = ssl.CERT_NONE
if conf.ssl.ciphers:
context.set_ciphers(conf.ssl.ciphers)
return context.wrap_socket(sock, server_side=True)
|
