0

My Sentry instance is located behind proxy that requires me to authenticate using client-side certificate. How do I make my Twisted application that uses Raven to succesfully pass this proxy? I don't see anything in raven.transport.Transport that could allow me specifying client cert, key and trust chain. What are my options?

1 Answer 1

0

OK, I found it. Not the cleanest solution but it works.

It turns out you can register your own Transport class with custom scheme. To make this work with client secrets (cert, key, chain) you have to specify them as query parameters to Sentry DSN url, like:

https://url/project?client_cert=f1&client_key=f2

and so on. These parameters are then passed to Transport constructor in kwargs. With Twisted v. 16.0.0 this may look like this:

class InstancePolicy(BrowserLikePolicyForHTTPS):

    def __init__(self, trustRoot=None,
            client_cert=None, client_key=None, client_trust_chain=None,
            server_ca_cert=None):
        if None in (client_cert, client_key):
            raise ValueError('When using client side SSL both certificate and key are required')
        super(InstancePolicy, self).__init__(trustRoot)
        self.client_cert_file = client_cert
        self.client_key_file = client_key
        self.client_trust_chain_file = client_trust_chain
        self.server_ca_cert_file = server_ca_cert

    @property
    def trust_source(self):
        src = self._trustRoot
        if self.server_ca_cert_file is not None:
            src = ssl.Certificate.loadPEM(FilePath(self.server_ca_cert_file).getContent())
        return src

    def creatorForNetloc(self, hostname, port):
        if self.client_cert_file is not None:
            key_pair = ssl.KeyPair.load(FilePath(self.client_key_file).getContent(), crypto.FILETYPE_PEM)
            client_cert = ssl.PrivateCertificate.load(FilePath(self.client_cert_file).getContent(),
                key_pair, crypto.FILETYPE_PEM)
        else:
            client_cert = None
        extra = {}
        if self.client_trust_chain_file is not None:
            chain = [ssl.Certificate.loadPEM(str(x)) for x in pem.parse_file(self.client_trust_chain_file)]
            extra['extraCertificateOptions'] = dict(extraCertChain=[x.original for x in chain])
        return ssl.optionsForClientTLS(
            hostname.decode('ascii'),
            trustRoot=self.trust_source,
            clientCertificate=client_cert,
            **extra
        )

Then you can use following function to build Agent instance to your liking:

def make_agent(reactor, policy=None):
    kw = {}
    if policy is not None:
        kw['contextFactory'] = policy
    return Agent(reactor, pool=HTTPConnectionPool(reactor), **kw)

With these components you can now define your own Transport subclass:

class TwistedHTTPSClientSSLTransport(TwistedHTTPTransport):
    scheme = ['twisted_clientssl+https']

    def __init__(self, parsed_url, *args, **kwargs):
        client_cert = kwargs.pop('client_cert', None)
        client_key = kwargs.pop('client_key', None)
        client_trust_chain = kwargs.pop('client_trust_chain', None)
        server_ca_cert = kwargs.pop('server_ca_cert', None)
        super(TwistedHTTPSClientSSLTransport, self).__init__(parsed_url, *args, **kwargs)
        policy = InstancePolicy(client_cert=client_cert,
            client_key=client_key, client_trust_chain=client_trust_chain,
            server_ca_cert=server_ca_cert)
        from twisted.internet import reactor
        self._agent = make_agent(reactor, policy)

Now before creating Raven Client instance you may register your Transport class for your custom scheme:

for sc in TwistedHTTPSClientSSLTransport.scheme:
    Client.register_scheme(sc, TwistedHTTPSClientSSLTransport)

And this works.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.