SSL in Python 2.6
Secure Sockets Layer (SSL) support in Python stdlib took a big leap forward with the introduction of the ssl module in Python 2.6.
Servers
The ssl module provides the means to build safe SSL servers just by using a stock installation of Python 2.6. There are still some pitfalls as usual, but it can be done by limiting compatibility.
The main problem with the ssl module in 2.6 in server use is that it is not possible to disable SSL version 2. This is important since SSL version 2 is insecure. And unfortuantely the most compatible mode selection with OpenSSL (on which Python’s SSL support is based) is to select the SSLv23 mode which on the server is compatible with all SSL and TLS versions supported by OpenSSL. OpenSSL does provide a way to select the SSLv23 mode and selectively turn off any SSL version, but this was not implemented in Python 2.6. It is available in at least M2Crypto, which is a 3rd party Python wrapper for OpenSSL that I maintain.
The 2.6 implementation will also not let you choose ciphers, so you are at the mercy of the protocol version you choose and the options that OpenSSL was compiled with. M2Crypto defaults to strong ciphers, and lets the application developers set any ciphers they wish.
With those important caveats, the server side SSL implementation looks reasonable, assuming you remember to provide the keyfile and certfile arguments to ssl.wrap_socket(). Especially if you can forgo some compatibility and limit your server to just TLSv1. (Transport Layer Security or TLS for short is the newer SSL.)
I wrote earlier how you can use M2Crypto to extract CA certificates from NSS project’s certdata.txt. You can also get free SSL server certificates that work in many (but not all) browsers from StartCom, for example. You still need to pay to cover all the mainstream browsers. In some use cases you may also be able to run your own CA and issue your own certificates but it is not for the faint of heart.
Here are sample servers written using stock Python 2.6 with SSL support compiled in, and M2Crypto 0.19:
Python 2.6 server:
import socket, ssl bindsocket = socket.socket() bindsocket.bind(('', 8000)) bindsocket.listen(5) newsocket, fromaddr = bindsocket.accept() c = ssl.wrap_socket(newsocket, server_side=True, certfile="servercert.pem", keyfile="serverkey.pem", ssl_version=ssl.PROTOCOL_SSLv3) print c.read() c.write('200 OK\r\n\r\n') c.close() bindsocket.close()
M2Crypto 0.19.1 server:
from M2Crypto import SSL ctx = SSL.Context('sslv3') ctx.load_cert(certfile="servercert.pem", keyfile="serverkey.pem") bindsocket = SSL.Connection(ctx) bindsocket.bind(('', 8000)) bindsocket.listen(5) c, fromaddr = bindsocket.accept() print c.read() c.write('200 OK\r\n\r\n') c.close() bindsocket.close()
The situation is not so good for the client side, although things have definitely improved.
Clients
The same SSLv2 issue and cipher issue is true for the client side as well. As a client developer, besides needing to specify ca_certs pointing to valid CA certificates for ssl.wrap_socket(), you will also need to remember to pass in cert_reqs=ssl.CERT_REQUIRED.
In addition, the client side needs to check that the certificate hostname (in the subjectAltName or commonName) matches the hostname that the client tried to connect to. If you don’t, you won’t know who you are talking to and your connection is subject to a man-in-the-middle attack. I was not able to convince Bill Janssen that this post connection check callback should be provided by the ssl module. I think there is value in doing a hostname check by default, and letting application developers override it if necessary. As it stands, you must code this check in the application code; you can get the peer certificate as a dictionary with getpeercert() method from the wrapped socket. Again, M2Crypto does this hostname check by default, but it can be overridden by the application if necessary. You might want to take a look at the M2Crypto checker code, although I am not convinced it is 100% correct per specifications (but it should err on the side of safety).
Below is a comparison of Python 2.6 and M2Crypto 0.19.1 clients.
Python 2.6 client:
from socket import socket import ssl s = socket() c = ssl.wrap_socket(s, cert_reqs=ssl.CERT_REQUIRED, ssl_version=ssl.PROTOCOL_SSLv3, ca_certs='ca.pem') c.connect(('www.google.com', 443)) # naive and incomplete check to see if cert matches host cert = c.getpeercert() if not cert or ('commonName', u'www.google.com') not in cert['subject'][4]: raise Exception('Danger!') c.write('GET / \n') c.close()
M2Crypto 0.19.1 client:
from M2Crypto import SSL ctx = SSL.Context('sslv3') # If you comment out the next 2 lines, the connection won't be secure ctx.set_verify(SSL.verify_peer | SSL.verify_fail_if_no_peer_cert, depth=9) if ctx.load_verify_locations('ca.pem') != 1: raise Exception('No CA certs') c = SSL.Connection(ctx) c.connect(('www.google.com', 443)) # automatically checks cert matches host c.send('GET / \n') c.close()
Certificate Revocations
Another aspect that affects especially clients, but also servers that have been set up to require peer certificates, is the issue of certificate revocation. The two standard ways of doing this are the Certificate Revocation Lists (CRL) and Online Certificate Status Protocol (OCSP), but the ssl module in Python 2.6 provides no support for these. Granted, they are not easy to deal with in any of the 3rd party libraries either, but at least they provide some APIs to deal with them. Python is not unique here, though, because many (most?) modern applications still do not do any revocation checks by default (if at all).
Other Libraries
Besides the stdlib’s ssl module and M2Crypto, there are other SSL options for the Python developers out there. You might want to take a look at pyOpenSSL, which is again being maintained. Or if you want a pure Python version which can use various crypto libraries for performance improvements, you might want to check out TLS Lite (although it hasn’t been updated in a while). An exiting new package you may want to pay attention to is python-nss, which is a Python wrapper for the Network Security Services (NSS) libraries from the Mozilla project. If there are other maintained Python SSL packages out there I would be interested in hearing about them.
