Class SSLTest

test/mitmproxy/proxy/layers/test_tls.py:86–141

Helper container for Python's builtin SSL object.

class SSLTest:
    """Helper container for Python's builtin SSL object."""

    def __init__(
        self,
        server_side: bool = False,
        alpn: list[str] | None = None,
        sni: bytes | None = b"example.mitmproxy.org",
        max_ver: ssl.TLSVersion | None = None,
        post_handshake_auth: bool = False,
    ):
        self.inc = ssl.MemoryBIO()
        self.out = ssl.MemoryBIO()
        self.ctx = ssl.SSLContext(
            ssl.PROTOCOL_TLS_SERVER if server_side else ssl.PROTOCOL_TLS_CLIENT
        )

        self.ctx.verify_mode = ssl.CERT_OPTIONAL
        self.ctx.post_handshake_auth = post_handshake_auth
        self.ctx.load_verify_locations(
            cafile=tlsdata.path("../../net/data/verificationcerts/trusted-root.crt"),
        )

        if alpn:
            self.ctx.set_alpn_protocols(alpn)
        if server_side:
            if sni == b"192.0.2.42":
                filename = "trusted-leaf-ip"
            else:
                filename = "trusted-leaf"
            self.ctx.load_cert_chain(
                certfile=tlsdata.path(
                    f"../../net/data/verificationcerts/{filename}.crt"
                ),
                keyfile=tlsdata.path(
                    f"../../net/data/verificationcerts/{filename}.key"
                ),
            )
        if max_ver:
            self.ctx.maximum_version = max_ver

        self.obj = self.ctx.wrap_bio(
            self.inc,
            self.out,
            server_hostname=None if server_side else sni,
            server_side=server_side,
        )

    def bio_write(self, buf: bytes) -> int:
        return self.inc.write(buf)

    def bio_read(self, bufsize: int = 2**16) -> bytes:
        return self.out.read(bufsize)

    def do_handshake(self) -> None:
        return self.obj.do_handshake()