网址库和服务器证书的验证

我使用 python 2.6 并请求 Facebook API (https(。我想我的服务可能是中间人攻击的目标。我今天早上再次发现 urllib 模块文档：引文：

Warning : When opening HTTPS URLs, it is not attempted to validate the server certificate. Use at your own risk!

您是否有提示/url/示例来完成完整的证书验证？

感谢您的帮助

您可以创建一个 urllib2 打开器，它可以使用自定义处理程序为您进行验证。以下代码是使用 Python 2.7.3 的示例。它假定您已将 http://curl.haxx.se/ca/cacert.pem 下载到保存脚本的同一文件夹中。

#!/usr/bin/env python
import urllib2
import httplib
import ssl
import socket
import os
CERT_FILE = os.path.join(os.path.dirname(__file__), 'cacert.pem')

class ValidHTTPSConnection(httplib.HTTPConnection):
        "This class allows communication via SSL."
        default_port = httplib.HTTPS_PORT
        def __init__(self, *args, **kwargs):
            httplib.HTTPConnection.__init__(self, *args, **kwargs)
        def connect(self):
            "Connect to a host on a given (SSL) port."
            sock = socket.create_connection((self.host, self.port),
                                            self.timeout, self.source_address)
            if self._tunnel_host:
                self.sock = sock
                self._tunnel()
            self.sock = ssl.wrap_socket(sock,
                                        ca_certs=CERT_FILE,
                                        cert_reqs=ssl.CERT_REQUIRED)

class ValidHTTPSHandler(urllib2.HTTPSHandler):
    def https_open(self, req):
            return self.do_open(ValidHTTPSConnection, req)
opener = urllib2.build_opener(ValidHTTPSHandler)

def test_access(url):
    print "Acessing", url
    page = opener.open(url)
    print page.info()
    data = page.read()
    print "First 100 bytes:", data[0:100]
    print "Done accesing", url
    print ""
# This should work
test_access("https://www.google.com")
# Accessing a page with a self signed certificate should not work
# At the time of writing, the following page uses a self signed certificate
test_access("https://tidia.ita.br/")

运行此脚本，您应该看到如下所示的输出：

Acessing https://www.google.com
Date: Mon, 14 Jan 2013 14:19:03 GMT
Expires: -1
...
First 100 bytes: <!doctype html><html itemscope="itemscope" itemtype="http://schema.org/WebPage"><head><meta itemprop
Done accesing https://www.google.com
Acessing https://tidia.ita.br/
Traceback (most recent call last):
  File "https_validation.py", line 54, in <module>
    test_access("https://tidia.ita.br/")
  File "https_validation.py", line 42, in test_access
    page = opener.open(url)
  ...
  File "/usr/local/Cellar/python/2.7.3/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py", line 1177, in do_open
    raise URLError(err)
urllib2.URLError: <urlopen error [Errno 1] _ssl.c:504: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed>

如果您有受信任的证书颁发机构 (CA( 文件，则可以使用 Python 2.6 及更高版本的 ssl 库来验证证书。下面是一些代码：

import os.path
import ssl
import sys
import urlparse
import urllib
def get_ca_path():
    '''Download the Mozilla CA file cached by the cURL project.
    If you have a trusted CA file from your OS, return the path
    to that instead.
    '''
    cafile_local = 'cacert.pem'
    cafile_remote = 'http://curl.haxx.se/ca/cacert.pem'
    if not os.path.isfile(cafile_local):
        print >> sys.stderr, "Downloading %s from %s" % (
            cafile_local, cafile_remote)
    urllib.urlretrieve(cafile_remote, cafile_local)
    return cafile_local
def check_ssl(hostname, port=443):
    '''Check that an SSL certificate is valid.'''
    print >> sys.stderr, "Validating SSL cert at %s:%d" % (
        hostname, port)
    cafile_local = get_ca_path()
    try:
        server_cert = ssl.get_server_certificate((hostname, port),
            ca_certs=cafile_local)
    except ssl.SSLError:
        print >> sys.stderr, "SSL cert at %s:%d is invalid!" % (
            hostname, port)
        raise 
class CheckedSSLUrlOpener(urllib.FancyURLopener):
    '''A URL opener that checks that SSL certificates are valid
    On SSL error, it will raise ssl.
    '''
    def open(self, fullurl, data = None):
        urlbits = urlparse.urlparse(fullurl)
        if urlbits.scheme == 'https':
            if ':' in urlbits.netloc:
                hostname, port = urlbits.netloc.split(':')
            else:
                hostname = urlbits.netloc
                if urlbits.port is None:
                    port = 443
                else:
                    port = urlbits.port
            check_ssl(hostname, port)
        return urllib.FancyURLopener.open(self, fullurl, data)
# Plain usage - can probably do once per day
check_ssl('www.facebook.com')
# URL Opener
opener = CheckedSSLUrlOpener()
opener.open('https://www.facebook.com/find-friends/browser/')
# Make it the default
urllib._urlopener = opener
urllib.urlopen('https://www.facebook.com/find-friends/browser/')

此代码的一些危险：

您必须信任来自 cURL 项目 (http://curl.haxx.se/ca/cacert.pem( 的 CA 文件，它是 Mozilla CA 文件的缓存版本。它也是通过HTTP进行的，因此存在潜在的MITM攻击。最好将get_ca_path替换为返回本地 CA 文件的文件，该文件因主机而异。
没有尝试查看 CA 文件是否已更新。最终，根证书将过期或停用，并添加新证书。一个好主意是使用 cron 作业删除缓存的 CA 文件，以便每天下载一个新文件。
每次检查证书可能有点矫枉过正。您可以在每次运行中手动检查一次，或者在运行过程中保留"已知良好"主机的列表。或者，偏执！

相关内容

最新更新

热门标签：