Add support for SSL_peek #294

mhils · 2015-07-25T10:20:11Z

This PR adds support for OpenSSL's SSL_peek command, which is OpenSSL's (undocumented) equivalent of MSG_PEEK for normal sockets. I went for the straightforward way and mirrored the Python socket API - if you prefer a separate peek method, I'm happy to adjust the PR.
Tests may fail for now, as this requires the next cryptography release.

codecov-io · 2015-07-26T11:49:10Z

Current coverage is `92.56%`

Merging #294 into master will increase coverage by +0.02% as of 9727e1b

@@            master    #294   diff @@
======================================
  Files           14      14       
  Stmts         5347    5365    +18
  Branches       483     486     +3
  Methods          0       0       
======================================
+ Hit           4948    4966    +18
  Partial        157     157       
  Missed         242     242

Review entire Coverage Diff as of 9727e1b

Powered by Codecov. Updated on successful CI builds.

hynek · 2015-07-26T12:05:54Z

Since pyOpenSSL mostly attempts to mirror OpenSSL APIs, I think the approach is okay. We’ll have to wait for the next cryptography release then I guess.

mhils · 2015-08-12T14:44:17Z

I cannot restart the tests, but I think we're good to go now. 😃

hynek · 2015-08-13T06:37:59Z

OpenSSL/test/test_ssl.py

+        """
+        server, client = self._loopback()
+        server.send(b('xy'))
+        self.assertEquals(client.recv(2, MSG_PEEK), b('xy'))


please use assertEqual (no s) in new code, this variant is deprecated

hynek · 2015-08-13T06:40:57Z

sadly our pypy-builder is broken now :-/

meanwhile:

you’ll have to update doc/api/ssl.rst (sadly Connection isn’t on autodoc yet)
add a changelog entry

hynek · 2015-08-13T06:41:46Z

OpenSSL/SSL.py

        :return: The string read from the Connection
        """
        buf = _ffi.new("char[]", bufsiz)
-        result = _lib.SSL_read(self._ssl, buf, bufsiz)
+        if flags and flags & socket.MSG_PEEK:


please use flags is not None

hynek · 2015-08-13T06:43:10Z

you probably also should rebase while you’re at it, thanks :)

mhils · 2015-08-17T00:46:12Z

Thanks for the feedback. I fixed alle the issues mentioned above and also added MSG_PEEK support to recv_into. 😃

hynek · 2015-08-17T10:21:29Z

ChangeLog

@@ -1,3 +1,8 @@
+2015-08-17  Maximilian Hils <[email protected]>
+
+	* OpenSSL/SSL.py, : Add support for the ``MSG_PEEK`` flag to


while we have shit terrible changlog format you’ll have to add OpenSSL/test/test_ssl.py here too (and no trailing comma please, it slid in the previous entry, feel free to remove it :))

hynek · 2015-08-17T10:58:15Z

Thanks, I’ll wait for #298 to be merged now. As soon as we have a green Travis again, please rebase and we’ll finally be able to merge. Sorry for the inconvenience.

hynek · 2015-08-17T11:10:07Z

OpenSSL/test/test_ssl.py

@@ -2998,6 +3008,15 @@ def test_bytearray_really_doesnt_overfill(self):
        """
        self._doesnt_overfill_test(bytearray)

+    def test_peek(self):


oh and while we’re waiting, pyOpenSSL has sadly the gross code convention to leave two lines between methods on a class, so you’ll have to fix it here and in the read tests too. I’m sorry, I really wish it hadn’t.

Alright. 😉
Fixed.

hynek · 2015-08-17T15:08:50Z

Rebase pls and report back. :)

mhils · 2015-08-17T17:29:30Z

Here you go. 😉

Add support for SSL_peek

hynek · 2015-08-18T18:48:22Z

thanks for trooping through :)

Changes: 16.0.0 (2016-03-19) ------------------- This is the first release under full stewardship of PyCA. We have made *many* changes to make local development more pleasing. The test suite now passes both on Linux and OS X with OpenSSL 0.9.8, 1.0.1, and 1.0.2. It has been moved to `py.test <https://pytest.org/>`_, all CI test runs are part of `tox <https://testrun.org/tox/>`_ and the source code has been made fully `flake8 <https://flake8.readthedocs.org/>`_ compliant. We hope to have lowered the barrier for contributions significantly but are open to hear about any remaining frustrations. Backward-incompatible changes: ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ - Python 3.2 support has been dropped. It never had significant real world usage and has been dropped by our main dependency ``cryptography``. Affected users should upgrade to Python 3.3 or later. Deprecations: ^^^^^^^^^^^^^ - The support for EGD has been removed. The only affected function ``OpenSSL.rand.egd()`` now uses ``os.urandom()`` to seed the internal PRNG instead. Please see `pyca/cryptography#1636 <https://github.com/pyca/cryptography/pull/1636>`_ for more background information on this decision. In accordance with our backward compatibility policy ``OpenSSL.rand.egd()`` will be *removed* no sooner than a year from the release of 16.0.0. Please note that you should `use urandom <http://sockpuppet.org/blog/2014/02/25/safely-generate-random-numbers/>`_ for all your secure random number needs. - Python 2.6 support has been deprecated. Our main dependency ``cryptography`` deprecated 2.6 in version 0.9 (2015-05-14) with no time table for actually dropping it. pyOpenSSL will drop Python 2.6 support once ``cryptography`` does. Changes: ^^^^^^^^ - Fixed ``OpenSSL.SSL.Context.set_session_id``, ``OpenSSL.SSL.Connection.renegotiate``, ``OpenSSL.SSL.Connection.renegotiate_pending``, and ``OpenSSL.SSL.Context.load_client_ca``. They were lacking an implementation since 0.14. `#422 <https://github.com/pyca/pyopenssl/pull/422>`_ - Fixed segmentation fault when using keys larger than 4096-bit to sign data. `#428 <https://github.com/pyca/pyopenssl/pull/428>`_ - Fixed ``AttributeError`` when ``OpenSSL.SSL.Connection.get_app_data()`` was called before setting any app data. `#304 <https://github.com/pyca/pyopenssl/pull/304>`_ - Added ``OpenSSL.crypto.dump_publickey()`` to dump ``OpenSSL.crypto.PKey`` objects that represent public keys, and ``OpenSSL.crypto.load_publickey()`` to load such objects from serialized representations. `#382 <https://github.com/pyca/pyopenssl/pull/382>`_ - Added ``OpenSSL.crypto.dump_crl()`` to dump a certificate revocation list out to a string buffer. `#368 <https://github.com/pyca/pyopenssl/pull/368>`_ - Added ``OpenSSL.SSL.Connection.get_state_string()`` using the OpenSSL binding ``state_string_long``. `#358 <https://github.com/pyca/pyopenssl/pull/358>`_ - Added support for the ``socket.MSG_PEEK`` flag to ``OpenSSL.SSL.Connection.recv()`` and ``OpenSSL.SSL.Connection.recv_into()``. `#294 <https://github.com/pyca/pyopenssl/pull/294>`_ - Added ``OpenSSL.SSL.Connection.get_protocol_version()`` and ``OpenSSL.SSL.Connection.get_protocol_version_name()``. `#244 <https://github.com/pyca/pyopenssl/pull/244>`_ - Switched to ``utf8string`` mask by default. OpenSSL formerly defaulted to a ``T61String`` if there were UTF-8 characters present. This was changed to default to ``UTF8String`` in the config around 2005, but the actual code didn't change it until late last year. This will default us to the setting that actually works. To revert this you can call ``OpenSSL.crypto._lib.ASN1_STRING_set_default_mask_asc(b"default")``. `#234 <https://github.com/pyca/pyopenssl/pull/234>`_

mhils mentioned this pull request Jul 25, 2015

Fallback to TCP Proxying on non-standard HTTP traffic mitmproxy/mitmproxy#483

Closed

hynek reviewed Aug 13, 2015
View reviewed changes

mhils force-pushed the ssl_peek branch from 24093e7 to c8cfb99 Compare August 17, 2015 00:16

hynek reviewed Aug 17, 2015
View reviewed changes

mhils force-pushed the ssl_peek branch from c8cfb99 to 1080568 Compare August 17, 2015 10:35

hynek reviewed Aug 17, 2015
View reviewed changes

mhils force-pushed the ssl_peek branch from 1080568 to 84d1511 Compare August 17, 2015 11:17

add ssl_peek functionality

1d95dea

mhils force-pushed the ssl_peek branch from 84d1511 to 1d95dea Compare August 17, 2015 17:27

hynek added a commit that referenced this pull request Aug 18, 2015

Merge pull request #294 from mhils/ssl_peek

2db996e

Add support for SSL_peek

hynek merged commit 2db996e into pyca:master Aug 18, 2015

github-actions bot locked as resolved and limited conversation to collaborators Aug 22, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add support for SSL_peek #294

Add support for SSL_peek #294

mhils commented Jul 25, 2015

codecov-io commented Jul 26, 2015

hynek commented Jul 26, 2015

mhils commented Aug 12, 2015

hynek Aug 13, 2015

hynek commented Aug 13, 2015

hynek Aug 13, 2015

hynek commented Aug 13, 2015

mhils commented Aug 17, 2015

hynek Aug 17, 2015

mhils Aug 17, 2015

hynek commented Aug 17, 2015

hynek Aug 17, 2015

mhils Aug 17, 2015

hynek commented Aug 17, 2015

mhils commented Aug 17, 2015

hynek commented Aug 18, 2015

		@@ -1,3 +1,8 @@
		2015-08-17 Maximilian Hils <[email protected]>

		* OpenSSL/SSL.py, : Add support for the ``MSG_PEEK`` flag to

Add support for SSL_peek #294

Add support for SSL_peek #294

Conversation

mhils commented Jul 25, 2015

codecov-io commented Jul 26, 2015

Current coverage is 92.56%

hynek commented Jul 26, 2015

mhils commented Aug 12, 2015

hynek Aug 13, 2015

Choose a reason for hiding this comment

hynek commented Aug 13, 2015

hynek Aug 13, 2015

Choose a reason for hiding this comment

hynek commented Aug 13, 2015

mhils commented Aug 17, 2015

hynek Aug 17, 2015

Choose a reason for hiding this comment

mhils Aug 17, 2015

Choose a reason for hiding this comment

hynek commented Aug 17, 2015

hynek Aug 17, 2015

Choose a reason for hiding this comment

mhils Aug 17, 2015

Choose a reason for hiding this comment

hynek commented Aug 17, 2015

mhils commented Aug 17, 2015

hynek commented Aug 18, 2015

Current coverage is `92.56%`