Cutlery/calibre
1
0
Fork 0
mirror of https://github.com/kovidgoyal/calibre.git synced 2025-07-09 03:04:10 -04:00
Code Issues Packages Projects Releases Wiki Activity

Server: Disallow client initiated SSL renegotiation

Browse Source
This commit is contained in:
Kovid Goyal 2017-06-23 11:40:18 +05:30
parent 3574807c34
commit 90622d4129
No known key found for this signature in database
GPG Key ID: 06BC317B515ACE7C
1 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/calibre/srv/loop.py
View File

@ -136,6 +136,7 @@ class Connection(object): # {{{
self.response_started = False
self.read_buffer = ReadBuffer()
self.handle_event = None
self.ssl_handshake_done = False
if self.ssl_context is not None:
self.ready = False
self.socket = self.ssl_context.wrap_socket(socket, server_side=True, do_handshake_on_connect=False)
@ -178,6 +179,7 @@ class Connection(object): # {{{
except ssl.SSLWantWriteError:
self.set_state(WRITE, self.do_ssl_handshake)
else:
self.ssl_handshake_done = True
self.connection_ready()
def send(self, data):
@ -337,6 +339,7 @@ class ServerLoop(object):
if self.opts.ssl_certfile is not None and self.opts.ssl_keyfile is not None:
self.ssl_context = ssl.create_default_context(ssl.Purpose.CLIENT_AUTH)
self.ssl_context.load_cert_chain(certfile=self.opts.ssl_certfile, keyfile=self.opts.ssl_keyfile)
self.ssl_context.set_servername_callback(self.on_ssl_servername)
self.pre_activated_socket = None
if self.opts.allow_socket_preallocation:
@ -350,6 +353,12 @@ class ServerLoop(object):
self.pool = ThreadPool(self.log, self.job_completed, count=self.opts.worker_count)
self.plugin_pool = PluginPool(self, plugins)
def on_ssl_servername(self, socket, server_name, ssl_context):
c = self.connection_map.get(socket.fileno())
if c.ssl_handshake_done:
# We do not allow client initiated SSL renegotiation
return ssl.ALERT_DESCRIPTION_NO_RENEGOTIATION
def create_control_connection(self):
self.control_in, self.control_out = create_sock_pair()