mirror.MikroTik/socialwifi.RouterOS-api
1
0
Fork 0
mirror of https://github.com/socialwifi/RouterOS-api.git synced 2025-08-31 15:19:25 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Finish SSL support changes. Add optional verification of the certificate.

Browse source
This commit is contained in:
Steve Haskew 2018-06-22 12:22:39 +01:00
parent bacf3c9166
commit 8da8a9a241
2 changed files with 22 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

14
routeros_api/api.py
View file

@ -9,19 +9,25 @@ from routeros_api import exceptions
from routeros_api import resource
def connect(host, username='admin', password='', port=8728, ca_cert=None):
return RouterOsApiPool(host, username, password, port, ca_cert).get_api()
def connect(host, username='admin', password='', port=8728, use_ssl=False, ssl_verify=True, ssl_verify_hostname=True, ca_cert=None):
return RouterOsApiPool(host, username, password, port, use_ssl, ssl_verify, ssl_verify_hostname, ca_cert).get_api()
class RouterOsApiPool(object):
socket_timeout = 15.
def __init__(self, host, username='admin', password='', port=8728, ca_cert=None):
def __init__(self, host, username='admin', password='', port=8728, use_ssl=False, ssl_verify=True, ssl_verify_hostname=True, ca_cert=None):
self.host = host
self.username = username
self.password = password
self.port = port
self.ca_cert = None
# Use SSL? Does not auto-switch to port 8729.
self.use_ssl = use_ssl
# Verify SSL certificate?
self.ssl_verify = ssl_verify
# Verify SSL hostname? (Ignored if certificate verification disabled)
self.ssl_verify_hostname = ssl_verify_hostname
self.connected = False
self.socket = api_socket.DummySocket()
self.communication_exception_parser = (
@ -30,7 +36,7 @@ class RouterOsApiPool(object):
def get_api(self):
if not self.connected:
self.socket = api_socket.get_socket(self.host, self.port,
timeout=self.socket_timeout, ca_cert=self.ca_cert)
timeout=self.socket_timeout, use_ssl=self.use_ssl, ssl_verify=self.ssl_verify, ssl_verify_hostname=self.ssl_verify_hostname, ca_cert=self.ca_cert)
base = base_api.Connection(self.socket)
communicator = api_communicator.ApiCommunicator(base)
self.api = RouterOsApi(communicator)

17
routeros_api/api_socket.py
View file

@ -1,4 +1,5 @@
import socket
import ssl
from routeros_api import exceptions
try:
import errno
@ -7,7 +8,7 @@ except ImportError:
EINTR = getattr(errno, 'EINTR', 4)
def get_socket(hostname, port, ca_cert=None, timeout=15.0):
def get_socket(hostname, port, use_ssl=False, ssl_verify=True, ssl_verify_hostname=True, ca_cert=None, timeout=15.0):
api_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
api_socket.settimeout(timeout)
while True:
@ -19,11 +20,17 @@ def get_socket(hostname, port, ca_cert=None, timeout=15.0):
else:
break
set_keepalive(api_socket, after_idle_sec=10)
if ca_cert:
if use_ssl:
context = ssl.create_default_context(cafile=ca_cert)
context.verify_mode = ssl.CERT_REQUIRED
context.check_hostname = False
api_soket = context.wrap_socket(s)
if ssl_verify:
# Verify certificate and hostname matches
context.check_hostname = ssl_verify_hostname
context.verify_mode = ssl.CERT_REQUIRED
else:
# Don't verify certificate or a match
context.check_hostname = False
context.verify_mode = ssl.CERT_NONE
api_socket = context.wrap_socket(api_socket,server_hostname=hostname)
return SocketWrapper(api_socket)
# http://stackoverflow.com/a/14855726