chenjintao
3e463f57b6
Configure the default WSS endpoint and ISRG Root X2 trust anchor, preserve device authentication, enforce TLS and WebSocket handshake validation, and handle partial I/O and connection cleanup. Add host tests, server probes, package verification and integration documentation. Backend 443 /ws still returns HTTP 404; on-device validation remains pending.
37 lines
1.7 KiB
Python
37 lines
1.7 KiB
Python
import hashlib
|
|
import json
|
|
import re
|
|
import socket
|
|
import ssl
|
|
from pathlib import Path
|
|
|
|
root = Path(__file__).resolve().parents[1]
|
|
source = (root / 'ql-application/threadx/interface/custom_app/talkingq_root_ca.c').read_text()
|
|
pem = ''.join(json.loads('"' + value + '"') for value in re.findall(r'"(.*?)"', source) if 'CERTIFICATE' in value or value.endswith(r'\n'))
|
|
context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
|
|
context.load_verify_locations(cadata=pem)
|
|
context.minimum_version = ssl.TLSVersion.TLSv1_2
|
|
context.maximum_version = ssl.TLSVersion.TLSv1_2
|
|
server = 'banban.api.talkingq.com'
|
|
report = {'root_sha256': hashlib.sha256(ssl.PEM_cert_to_DER_cert(pem)).hexdigest(), 'trust': 'only the compiled root CA; no OS trust or intermediate download'}
|
|
with socket.create_connection((server, 443), timeout=15) as tcp:
|
|
with context.wrap_socket(tcp, server_hostname=server) as tls:
|
|
report['tls'] = tls.version()
|
|
report['cipher'] = tls.cipher()
|
|
report['root_only_validation'] = 'PASS'
|
|
try:
|
|
with socket.create_connection((server, 443), timeout=15) as tcp:
|
|
with context.wrap_socket(tcp, server_hostname='wrong.invalid'):
|
|
raise AssertionError('wrong hostname accepted')
|
|
except ssl.SSLCertVerificationError:
|
|
report['wrong_hostname_rejected'] = True
|
|
empty = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
|
|
try:
|
|
with socket.create_connection((server, 443), timeout=15) as tcp:
|
|
with empty.wrap_socket(tcp, server_hostname=server):
|
|
raise AssertionError('untrusted CA accepted')
|
|
except ssl.SSLCertVerificationError:
|
|
report['untrusted_ca_rejected'] = True
|
|
(root / 'artifacts/wss/root-only-probe.json').write_text(json.dumps(report, indent=2))
|
|
print(json.dumps(report, indent=2))
|