Adding support for TLS authentication

[barsand]

Continuation of PR #1188.

With this change added, one can use a dict with extra information to be added to socket creation on load_ssl_context.

Adding a more complex set of parameters to ssl_context, when using Flask, for example, will be possible through a new valid instance of ssl context, such as:

from flask import Flask
app = Flask(__name__)
ssl_context = {
		'cert_file': 'auth/server/crt.crt',
		'pkey_file': 'auth/server/key.key',
		'ca_certs': 'auth/server/ca.crt',
		'cert_reqs': ssl.CERT_REQUIRED
	}
	app.run(debug=True, ssl_context=ssl_context)

If possible - and valid, returned values from SSLSocket.getpeercert will be stored into environ['SSL_CLIENT_CERT'].

[davidism]

I'm trying to verify this, but as soon as I add ssl.CERT_REQUIRED, Firefox gives me SEC_ERROR_LIBRARY_FAILURE. Can't tell if it's a problem with my machine/Firefox, or with the way I generated the cert. I used mkcert:

$ mkcert -install
$ mkcert localhost
$ mkcert -client david

ssl_context={
    'keyfile': 'localhost-key.pem',
    'certfile': 'localhost.pem',
    'ca_certs': '/home/david/.local/share/mkcert/rootCA.pem',
    'cert_reqs': ssl.CERT_REQUIRED,
}

[davidism]

Must have been my computer, I tried on another and it's working as expected.

[davidism]

While self.connection.getpeercert() gives very nice information, it won't match what Nginx or another server could put in the SSL_CLIENT_CERT header. Nginx passes the cert in PEM format. getpeercert(binary_form=True) returns DER bytes, which can be converted to PEM. cryptography can be used to read the cert.

from cryptography import x509
from cryptography.hazmat.backends import default_backend
x509.load_pem_x509_certificate(cert.encode('ascii'), default_backend())

Also rolling back the ability to pass a dict to ssl_context. I started trying to write documentation for it and it was looking too complicated. Werkzeug already supports passing a real SSLContext object for complex stuff like this.

context = ssl.SSLContext()
context.load_cert_chain("localhost.pem", "localhost-key.pem")
context.load_verify_locations("/home/david/.local/share/mkcert/rootCA.pem")
context.verify_mode = ssl.CERT_REQUIRED