Skip to content

Commit

Permalink
feat(utils): extend create_tcp_connection utility (#568)
Browse files Browse the repository at this point in the history
Add parameters to setup SSL context options and ciphers when playing with secure connection.
It can be set via a handler:
```
class MySequentialThreadingHandler(SequentialThreadingHandler):
    def create_connection(self, *args, **kwargs):
        return create_tcp_connection(socket, options=MY_OPTIONS, ciphers=MY_CIPHERS,
                                     *args, **kwargs)
```
  • Loading branch information
Paweł Szulik authored and StephenSorriaux committed Aug 6, 2019
1 parent 88b657a commit ab0cd00
Showing 1 changed file with 11 additions and 3 deletions.
14 changes: 11 additions & 3 deletions kazoo/handlers/utils.py
Original file line number Diff line number Diff line change
Expand Up @@ -191,7 +191,7 @@ def create_tcp_socket(module):
def create_tcp_connection(module, address, timeout=None,
use_ssl=False, ca=None, certfile=None,
keyfile=None, keyfile_password=None,
verify_certs=True):
verify_certs=True, options=None, ciphers=None):
end = None
if timeout is None:
# thanks to create_connection() developers for
Expand All @@ -211,8 +211,16 @@ def create_tcp_connection(module, address, timeout=None,
if use_ssl:
# Disallow use of SSLv2 and V3 (meaning we require TLSv1.0+)
context = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
context.options |= ssl.OP_NO_SSLv2
context.options |= ssl.OP_NO_SSLv3

if options is not None:
context.options = options
else:
context.options |= ssl.OP_NO_SSLv2
context.options |= ssl.OP_NO_SSLv3

if ciphers:
context.set_ciphers(ciphers)

# Load default CA certs
context.load_default_certs(ssl.Purpose.SERVER_AUTH)
context.verify_mode = (
Expand Down

0 comments on commit ab0cd00

Please sign in to comment.