Support https server

webssh/main.py

@@ -4,8 +4,10 @@ import tornado.ioloop
 
 from tornado.options import options
 from webssh.handler import IndexHandler, WsockHandler
-from webssh.settings import (get_app_settings, get_host_keys_settings,
-                             get_policy_setting, max_body_size)
+from webssh.settings import (
+    get_app_settings,  get_host_keys_settings, get_policy_setting,
+    get_ssl_context, max_body_size, xheaders
+)
 
 
 def make_handlers(loop, options):
@@ -28,9 +30,15 @@ def main():
     options.parse_command_line()
     loop = tornado.ioloop.IOLoop.current()
     app = make_app(make_handlers(loop, options), get_app_settings(options))
-    server_settings = dict(xheaders=True, max_body_size=max_body_size)
-    app.listen(options.port, options.address, **server_settings)
+    ssl_ctx = get_ssl_context(options)
+    kwargs = dict(xheaders=xheaders, max_body_size=max_body_size)
+    app.listen(options.port, options.address, **kwargs)
     logging.info('Listening on {}:{}'.format(options.address, options.port))
+    if ssl_ctx:
+        kwargs.update(ssl_options=ssl_ctx)
+        app.listen(options.sslPort, options.sslAddress, **kwargs)
+        logging.info('Listening on ssl {}:{}'.format(options.sslAddress,
+                                                     options.sslPort))
     loop.start()
 
 

webssh/settings.py

@@ -1,5 +1,6 @@
 import logging
 import os.path
+import ssl
 import sys
 
 from tornado.options import define
@@ -17,6 +18,10 @@ def print_version(flag):
 
 define('address', default='127.0.0.1', help='Listen address')
 define('port', type=int, default=8888,  help='Listen port')
+define('sslAddress', default='0.0.0.0', help='SSL listen address')
+define('sslPort', type=int, default=4433,  help='SSL listen port')
+define('certfile', default='', help='SSL certificate file')
+define('keyfile', default='', help='SSL key file')
 define('debug', type=bool, default=False, help='Debug mode')
 define('policy', default='warning',
        help='Missing host key policy, reject|autoadd|warning')
@@ -30,6 +35,7 @@ define('version', type=bool, help='Show version information',
 base_dir = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
 max_body_size = 1 * 1024 * 1024
 swallow_http_errors = True
+xheaders = True
 
 
 def get_app_settings(options):
@@ -69,3 +75,20 @@ def get_policy_setting(options, host_keys_settings):
     logging.info(policy_class.__name__)
     check_policy_setting(policy_class, host_keys_settings)
     return policy_class()
+
+
+def get_ssl_context(options):
+    if not options.certfile and not options.keyfile:
+        return None
+    elif not options.certfile:
+        raise ValueError('certfile is not provided')
+    elif not options.keyfile:
+        raise ValueError('keyfile is not provided')
+    elif not os.path.isfile(options.certfile):
+        raise ValueError('File {!r} does not exist'.format(options.certfile))
+    elif not os.path.isfile(options.keyfile):
+        raise ValueError('File {!r} does not exist'.format(options.keyfile))
+    else:
+        ssl_ctx = ssl.create_default_context(ssl.Purpose.CLIENT_AUTH)
+        ssl_ctx.load_cert_chain(options.certfile, options.keyfile)
+        return ssl_ctx