Skip to content

Commit

Permalink
Add ca_cert_data parameter to Python client.
Browse files Browse the repository at this point in the history
This lets a client validate a server's CA certificate chain using a
variable/constant containing PEM (`str`) or DER (`bytes`) data, rather than
needing to reference a file on disk.
  • Loading branch information
micolous committed Feb 20, 2025
1 parent 9374dbd commit f846077
Show file tree
Hide file tree
Showing 11 changed files with 43 additions and 2 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,8 @@ class RESTClientObject:
self.maxsize = configuration.connection_pool_maxsize

self.ssl_context = ssl.create_default_context(
cafile=configuration.ssl_ca_cert
cafile=configuration.ssl_ca_cert,
cadata=configuration.ca_cert_data,
)
if configuration.cert_file:
self.ssl_context.load_cert_chain(
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -183,6 +183,8 @@ class Configuration:
:param ssl_ca_cert: str - the path to a file of concatenated CA certificates
in PEM format.
:param retries: Number of retries for API requests.
:param ca_cert_data: str|bytes - verify the peer using concatenated CA
certificate data in PEM (str) or DER (bytes) format.

{{#hasAuthMethods}}
:Example:
Expand Down Expand Up @@ -289,6 +291,7 @@ conf = {{{packageName}}}.Configuration(
ignore_operation_servers: bool=False,
ssl_ca_cert: Optional[str]=None,
retries: Optional[int] = None,
ca_cert_data: Optional[str | bytes] = None,
*,
debug: Optional[bool] = None,
) -> None:
Expand Down Expand Up @@ -373,6 +376,10 @@ conf = {{{packageName}}}.Configuration(
self.ssl_ca_cert = ssl_ca_cert
"""Set this to customize the certificate file to verify the peer.
"""
self.ca_cert_data = ca_cert_data
"""Set this to verify the peer using PEM (str) or DER (bytes)
certificate data.
"""
self.cert_file = None
"""client certificate file
"""
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -66,6 +66,7 @@ class RESTClientObject:
"ca_certs": configuration.ssl_ca_cert,
"cert_file": configuration.cert_file,
"key_file": configuration.key_file,
"ca_cert_data": configuration.ca_cert_data,
}
if configuration.assert_hostname is not None:
pool_args['assert_hostname'] = (
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -163,6 +163,8 @@ class Configuration:
:param ssl_ca_cert: str - the path to a file of concatenated CA certificates
in PEM format.
:param retries: Number of retries for API requests.
:param ca_cert_data: str|bytes - verify the peer using concatenated CA
certificate data in PEM (str) or DER (bytes) format.
:Example:
Expand Down Expand Up @@ -200,6 +202,7 @@ def __init__(
ignore_operation_servers: bool=False,
ssl_ca_cert: Optional[str]=None,
retries: Optional[int] = None,
ca_cert_data: Optional[str | bytes] = None,
*,
debug: Optional[bool] = None,
) -> None:
Expand Down Expand Up @@ -277,6 +280,10 @@ def __init__(
self.ssl_ca_cert = ssl_ca_cert
"""Set this to customize the certificate file to verify the peer.
"""
self.ca_cert_data = ca_cert_data
"""Set this to verify the peer using PEM (str) or DER (bytes)
certificate data.
"""
self.cert_file = None
"""client certificate file
"""
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -77,6 +77,7 @@ def __init__(self, configuration) -> None:
"ca_certs": configuration.ssl_ca_cert,
"cert_file": configuration.cert_file,
"key_file": configuration.key_file,
"ca_cert_data": configuration.ca_cert_data,
}
if configuration.assert_hostname is not None:
pool_args['assert_hostname'] = (
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -163,6 +163,8 @@ class Configuration:
:param ssl_ca_cert: str - the path to a file of concatenated CA certificates
in PEM format.
:param retries: Number of retries for API requests.
:param ca_cert_data: str|bytes - verify the peer using concatenated CA
certificate data in PEM (str) or DER (bytes) format.
:Example:
Expand Down Expand Up @@ -200,6 +202,7 @@ def __init__(
ignore_operation_servers: bool=False,
ssl_ca_cert: Optional[str]=None,
retries: Optional[int] = None,
ca_cert_data: Optional[str | bytes] = None,
*,
debug: Optional[bool] = None,
) -> None:
Expand Down Expand Up @@ -277,6 +280,10 @@ def __init__(
self.ssl_ca_cert = ssl_ca_cert
"""Set this to customize the certificate file to verify the peer.
"""
self.ca_cert_data = ca_cert_data
"""Set this to verify the peer using PEM (str) or DER (bytes)
certificate data.
"""
self.cert_file = None
"""client certificate file
"""
Expand Down
1 change: 1 addition & 0 deletions samples/client/echo_api/python/openapi_client/rest.py
Original file line number Diff line number Diff line change
Expand Up @@ -77,6 +77,7 @@ def __init__(self, configuration) -> None:
"ca_certs": configuration.ssl_ca_cert,
"cert_file": configuration.cert_file,
"key_file": configuration.key_file,
"ca_cert_data": configuration.ca_cert_data,
}
if configuration.assert_hostname is not None:
pool_args['assert_hostname'] = (
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -168,6 +168,8 @@ class Configuration:
:param ssl_ca_cert: str - the path to a file of concatenated CA certificates
in PEM format.
:param retries: Number of retries for API requests.
:param ca_cert_data: str|bytes - verify the peer using concatenated CA
certificate data in PEM (str) or DER (bytes) format.
:Example:
Expand Down Expand Up @@ -264,6 +266,7 @@ def __init__(
ignore_operation_servers: bool=False,
ssl_ca_cert: Optional[str]=None,
retries: Optional[int] = None,
ca_cert_data: Optional[str | bytes] = None,
*,
debug: Optional[bool] = None,
) -> None:
Expand Down Expand Up @@ -346,6 +349,10 @@ def __init__(
self.ssl_ca_cert = ssl_ca_cert
"""Set this to customize the certificate file to verify the peer.
"""
self.ca_cert_data = ca_cert_data
"""Set this to verify the peer using PEM (str) or DER (bytes)
certificate data.
"""
self.cert_file = None
"""client certificate file
"""
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,8 @@ def __init__(self, configuration) -> None:
self.maxsize = configuration.connection_pool_maxsize

self.ssl_context = ssl.create_default_context(
cafile=configuration.ssl_ca_cert
cafile=configuration.ssl_ca_cert,
cadata=configuration.ca_cert_data,
)
if configuration.cert_file:
self.ssl_context.load_cert_chain(
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -169,6 +169,8 @@ class Configuration:
:param ssl_ca_cert: str - the path to a file of concatenated CA certificates
in PEM format.
:param retries: Number of retries for API requests.
:param ca_cert_data: str|bytes - verify the peer using concatenated CA
certificate data in PEM (str) or DER (bytes) format.
:Example:
Expand Down Expand Up @@ -265,6 +267,7 @@ def __init__(
ignore_operation_servers: bool=False,
ssl_ca_cert: Optional[str]=None,
retries: Optional[int] = None,
ca_cert_data: Optional[str | bytes] = None,
*,
debug: Optional[bool] = None,
) -> None:
Expand Down Expand Up @@ -347,6 +350,10 @@ def __init__(
self.ssl_ca_cert = ssl_ca_cert
"""Set this to customize the certificate file to verify the peer.
"""
self.ca_cert_data = ca_cert_data
"""Set this to verify the peer using PEM (str) or DER (bytes)
certificate data.
"""
self.cert_file = None
"""client certificate file
"""
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -76,6 +76,7 @@ def __init__(self, configuration) -> None:
"ca_certs": configuration.ssl_ca_cert,
"cert_file": configuration.cert_file,
"key_file": configuration.key_file,
"ca_cert_data": configuration.ca_cert_data,
}
if configuration.assert_hostname is not None:
pool_args['assert_hostname'] = (
Expand Down

0 comments on commit f846077

Please sign in to comment.