libcloud/security.py

# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
"""
Security (SSL) Settings

Usage:
    import libcloud.security
    libcloud.security.VERIFY_SSL_CERT = True

    # Optional.
    libcloud.security.CA_CERTS_PATH = '/path/to/certfile'
"""

import os
import ssl

__all__ = ["VERIFY_SSL_CERT", "SSL_VERSION", "CA_CERTS_PATH"]

VERIFY_SSL_CERT = True

SSL_VERSION = ssl.PROTOCOL_TLSv1

# True to use certifi CA bundle path when certifi library is available
USE_CERTIFI = os.environ.get("LIBCLOUD_SSL_USE_CERTIFI", True)
USE_CERTIFI = str(USE_CERTIFI).lower() in ["true", "1"]

# File containing one or more PEM-encoded CA certificates
# concatenated together.
CA_CERTS_PATH = None

# Insert certifi CA bundle path to the front of Libcloud CA bundle search
# path if certifi is available
try:
    import certifi
except ImportError:
    has_certifi = False
else:
    has_certifi = True

if has_certifi and USE_CERTIFI:
    certifi_ca_bundle_path = certifi.where()
    CA_CERTS_PATH = certifi_ca_bundle_path

# Allow user to explicitly specify which CA bundle to use, using an environment
# variable
environment_cert_file = os.getenv("SSL_CERT_FILE", None)
if environment_cert_file is not None:
    # Make sure the file exists
    if not os.path.exists(environment_cert_file):
        raise ValueError("Certificate file %s doesn't exist" % (environment_cert_file))

    if not os.path.isfile(environment_cert_file):
        raise ValueError("Certificate file can't be a directory")

    # If a provided file exists we ignore other common paths because we
    # don't want to fall-back to a potentially less restrictive bundle
    CA_CERTS_PATH = environment_cert_file

CA_CERTS_UNAVAILABLE_ERROR_MSG = (
    "No CA Certificates were found in CA_CERTS_PATH. For information on "
    "how to get required certificate files, please visit "
    "https://libcloud.readthedocs.org/en/latest/other/"
    "ssl-certificate-validation.html"
)

VERIFY_SSL_DISABLED_MSG = (
    "SSL certificate verification is disabled, this can pose a "
    "security risk. For more information how to enable the SSL "
    "certificate verification, please visit the libcloud "
    "documentation."
)