Update the client and server configuration examples for TLS communication #1030

geryogam · 2018-05-02T13:19:47Z

ssl.PROTOCOL_TLSv1 is now deprecated (https://docs.python.org/3/library/ssl.html#ssl.PROTOCOL_TLSv1), ssl.PROTOCOL_TLS should be preferred, which is used by ssl.create_default_context among other parameters which provide a higher security level (https://docs.python.org/3/library/ssl.html#ssl.create_default_context).
Checking server hostnames prevents man-in-the-middle attacks (TLS/SSL support is vulnerable to MITM attacks #464).
RabbitMQ 3.7.0 introduced a new systemctl syntax for rabbitmq.conf (https://www.rabbitmq.com/configure.html#config-file).
TLS server configuration for HTTPS for the rabbitmq-management plugin might as well be demonstrated.

- ``ssl.PROTOCOL_TLSv1`` is now deprecated (https://docs.python.org/3/library/ssl.html#ssl.PROTOCOL_TLSv1), ``ssl.PROTOCOL_TLS`` should be preferred, which is used by ``ssl.create_default_context`` among other other parameters which provide a higher security level (https://docs.python.org/3/library/ssl.html#ssl.create_default_context); - checking server hostnames prevents man in the middle attacks (pika#464); - RabbitMQ 3.7.0 introduced a new systemctl syntax for rabbitmq.conf (https://www.rabbitmq.com/configure.html#config-file).

vitaly-krugl · 2018-05-03T03:45:06Z

docs/examples/tls_mutual_authentication.rst

+        cafile="/Users/me/tls-gen/basic/testca/cacert.pem")
+    context.load_cert_chain("/Users/me/tls-gen/basic/client/cert.pem",
+                            "/Users/me/tls-gen/basic/client/key.pem")
+    server_hostname = "example.com"


A single-use variable containing a simple value is unnecessary. Use 'example.com' directly in the pika.SSLOptions() instantiation below.

Okay, thanks for the review. Done.

vitaly-krugl · 2018-05-03T03:51:51Z

docs/examples/tls_mutual_authentication.rst


 rabbitmq.config::

-    %% Both the client and rabbitmq server were running on the same machine, a MacBookPro laptop.


@lukebakken or @michaelklishin : need you to review the rabbitmq sample config change here.

vitaly-krugl · 2018-05-03T03:52:58Z

docs/examples/tls_mutual_authentication.rst

+        cafile="/Users/me/tls-gen/basic/testca/cacert.pem")
+    context.load_cert_chain("/Users/me/tls-gen/basic/client/cert.pem",
+                            "/Users/me/tls-gen/basic/client/key.pem")
+    server_hostname = "example.com"


Please apply the suggested changes in this function as well:

pika/tests/acceptance/async_test_base.py

Line 120 in 9fb234c

def _new_tls_connection_params(self):

vitaly-krugl · 2018-05-03T15:05:16Z

docs/examples/tls_mutual_authentication.rst

-        ]
-      }
-    ].
+    # Enable A.M.Q.P.S.


Please make sure these are consistent with https://github.com/pika/pika/blob/master/testdata/rabbitmq.conf.in

You mean the paths of the certificates and private keys (I had kept the ones used in the old version of the example)? Done.

@maggyero, sorry, I should have been more specific - I meant the properties being set, not the values (e.g., file paths) themselves. Thank you.

To me the other properties in the suggested rabbitmq.conf.in (listeners.tcp.default = 5672, num_acceptors.tcp = 10, num_acceptors.ssl = 10, reverse_dns_lookups = false, loopback_users.guest = true, log.console = false, log.console.level = debug) are distracting for the reader who would expect only the necessary parameters for setting up TLS in an example like this.

I agree with @maggyero.

… directory

vitaly-krugl · 2018-05-03T19:18:26Z

See also issue #1035.

michaelklishin · 2018-05-03T23:53:54Z

docs/examples/tls_mutual_authentication.rst

+    ssl_options.verify = verify_peer
+    ssl_options.fail_if_no_peer_cert = true
+
+    # Enable H.T.T.P.S.


Can we change this to just "HTTPS" (this is not a music album cover ;)) and add a comment that says "See http://www.rabbitmq.com/ssl.html to learn more"? The rest looks reasonable to me.

From Wikipedia:

In English, abbreviations have traditionally been written with a full stop/period/point in place of the deleted part to show the ellipsis of letters—although the colon and apostrophe have also had this role—and with a space after full stops (e.g. "A. D."). In the case of most acronyms, each letter is an abbreviation of a separate word and, in theory, should get its own termination mark. Such punctuation is diminishing with the belief that the presence of all-capital letters is sufficient to indicate that the word is an abbreviation.
Some influential style guides, such as that of the BBC, no longer require punctuation to show ellipsis; some even proscribe it. Larry Trask, American author of The Penguin Guide to Punctuation, states categorically that, in British English, "this tiresome and unnecessary practice is now obsolete".
Nevertheless, some influential style guides, many of them American, still require periods in certain instances. For example, The New York Times' guide recommends following each segment with a period when the letters are pronounced individually, as in K.G.B., but not when pronounced as a word, as in NATO. The logic of this style is that the pronunciation is reflected graphically by the punctuation scheme.

But since periods are disappearing, I’ve just removed them (just note that they’re not wrong). Thanks for the review. Done.

add a comment that says "See http://www.rabbitmq.com/ssl.html to learn more"

It’s actually already there at the beginning of the example:

See https://www.rabbitmq.com/ssl.html for certificate generation and RabbitMQ TLS configuration.

michaelklishin · 2018-05-04T10:08:24Z

Thank you!

geryogam changed the title ~~Update the client and server configuration~~ Update the client and server configuration examples for TLS communication May 2, 2018

Change "SSL" to "TLS"

2c67d12

vitaly-krugl reviewed May 3, 2018

View reviewed changes

geryogam added 5 commits May 3, 2018 08:33

Correct a typo, remove an unnecessary variable and print

44c378e

Update async_test_base.py

aa93e5c

Use positional args

e6b59d1

Use single quotes

52c6bd0

Use AMQPS port

2ed596c

vitaly-krugl reviewed May 3, 2018

View reviewed changes

Change certificate and private key paths to that of the pika/testdata…

ad70718

… directory

vitaly-krugl mentioned this pull request May 3, 2018

Implement positive/negative tests for peer verification #1035

Open

michaelklishin requested changes May 3, 2018

View reviewed changes

Remove periods in initialisms

e2103be

michaelklishin approved these changes May 4, 2018

View reviewed changes

michaelklishin merged commit d51d9b3 into pika:master May 4, 2018

geryogam deleted the patch-1 branch May 4, 2018 13:17

lukebakken added this to the 1.0.0 milestone May 9, 2018

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update the client and server configuration examples for TLS communication #1030

Update the client and server configuration examples for TLS communication #1030

geryogam commented May 2, 2018 •

edited

vitaly-krugl May 3, 2018

geryogam May 3, 2018

vitaly-krugl May 3, 2018 •

edited

vitaly-krugl May 3, 2018

geryogam May 3, 2018

vitaly-krugl May 3, 2018

geryogam May 3, 2018 •

edited

vitaly-krugl May 3, 2018

geryogam May 3, 2018 •

edited

michaelklishin May 3, 2018

vitaly-krugl commented May 3, 2018

michaelklishin May 3, 2018

geryogam May 4, 2018 •

edited

geryogam May 4, 2018 •

edited

michaelklishin commented May 4, 2018


		rabbitmq.config::

		%% Both the client and rabbitmq server were running on the same machine, a MacBookPro laptop.

Update the client and server configuration examples for TLS communication #1030

Update the client and server configuration examples for TLS communication #1030

Conversation

geryogam commented May 2, 2018 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

vitaly-krugl May 3, 2018 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

geryogam May 3, 2018 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

geryogam May 3, 2018 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

vitaly-krugl commented May 3, 2018

Choose a reason for hiding this comment

geryogam May 4, 2018 • edited

Choose a reason for hiding this comment

geryogam May 4, 2018 • edited

Choose a reason for hiding this comment

michaelklishin commented May 4, 2018

geryogam commented May 2, 2018 •

edited

vitaly-krugl May 3, 2018 •

edited

geryogam May 3, 2018 •

edited

geryogam May 3, 2018 •

edited

geryogam May 4, 2018 •

edited

geryogam May 4, 2018 •

edited