Rezzect/syncplay
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

TLS cert rotation: attempt to load valid certs for 10 times before disabling TLS

Browse Source
This commit is contained in:
Alberto Sottile 2019-02-19 10:40:16 +01:00
parent e8d797550b
commit a60e6aac8a
3 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
syncplay/constants.py
View File

@ -187,6 +187,8 @@ STYLE_NOFILEITEM_COLOR = 'blue'
STYLE_NOTCONTROLLER_COLOR = 'grey' STYLE_NOTCONTROLLER_COLOR = 'grey'
STYLE_UNTRUSTEDITEM_COLOR = 'purple' STYLE_UNTRUSTEDITEM_COLOR = 'purple'
TLS_CERT_ROTATION_MAX_RETRIES = 10
USERLIST_GUI_USERNAME_OFFSET = 21 # Pixels USERLIST_GUI_USERNAME_OFFSET = 21 # Pixels
USERLIST_GUI_USERNAME_COLUMN = 0 USERLIST_GUI_USERNAME_COLUMN = 0
USERLIST_GUI_FILENAME_COLUMN = 3 USERLIST_GUI_FILENAME_COLUMN = 3

2
syncplay/protocols.py
View File

@ -669,7 +669,7 @@ class SyncServerProtocol(JSONCommandProtocol):
def handleTLS(self, message): def handleTLS(self, message):
inquiry = message["startTLS"] if "startTLS" in message else None inquiry = message["startTLS"] if "startTLS" in message else None
if "send" in inquiry: if "send" in inquiry:
if not self.isLogged() and self._factory.serverAcceptsTLS and self._factory.options is not None: if not self.isLogged() and self._factory.serverAcceptsTLS:
lastEditCertTime = self._factory.checkLastEditCertTime() lastEditCertTime = self._factory.checkLastEditCertTime()
if lastEditCertTime is not None and lastEditCertTime != self._factory.lastEditCertTime: if lastEditCertTime is not None and lastEditCertTime != self._factory.lastEditCertTime:
self._factory.updateTLSContextFactory() self._factory.updateTLSContextFactory()

6
syncplay/server.py
View File

@ -56,6 +56,7 @@ class SyncFactory(Factory):
self._statsDbHandle = None self._statsDbHandle = None
if tlsCertPath is not None: if tlsCertPath is not None:
self.certPath = tlsCertPath self.certPath = tlsCertPath
self._TLSattempts = 0
self._allowTLSconnections(self.certPath) self._allowTLSconnections(self.certPath)
else: else:
self.certPath = None self.certPath = None
@ -230,6 +231,7 @@ class SyncFactory(Factory):
self.options = contextFactory self.options = contextFactory
self.serverAcceptsTLS = True self.serverAcceptsTLS = True
print("TLS support is enabled.")
except Exception as e: except Exception as e:
self.options = None self.options = None
self.serverAcceptsTLS = False self.serverAcceptsTLS = False
@ -247,7 +249,9 @@ class SyncFactory(Factory):
def updateTLSContextFactory(self): def updateTLSContextFactory(self):
self._allowTLSconnections(self.certPath) self._allowTLSconnections(self.certPath)
self._TLSattempts += 1
if self._TLSattempts < constants.TLS_CERT_ROTATION_MAX_RETRIES:
self.serverAcceptsTLS = True
class StatsRecorder(object): class StatsRecorder(object):