xmlrpc, httplib and SSL

From: Roger Binns (rogerb_at_rogerbinns.com)
Date: 03/27/04 

Date: Fri, 26 Mar 2004 20:03:18 -0800

I have just spent several weeks mashing xmlrpc, httplib and SSL (from
M2Crypto) to work together. The current standard library has several
problems:

  - Builtin SSL is pretty much useless if you actually care
    about security
  - Poor HTTP authentication support
  - No server side stuff (SSL, HTTP authentication etc)
  - Pathological coding to ensure that at most one request is
    sent on a connection, rather than reusing an already open
    connection (http/1.1 keepalives)
  - Pathological coding to ensure that connections are closed
    from as many different places as possible
  - A broken model for dealing with who owns a connection socket.
    It all started when someone added a 'makefile' method that
    returned a dup'ed file descriptor since all there are
    all those close calls everywhere, so the reference counting
    sort of works on UNIX (where dup is a normal operation).
    This leads to even more heroic coding to work around the
    explicitly coded close's everywhere, and implement yet
    another layer of reference counting and encapsulation.
  - No real possibility of dealing with things like automatically
    reopening connections (eg if you have an HTTP/1.1 connection,
    make a request, stay idle for so long the other end closes the
    connection, and then try to send a new one)

I now have code that works for me and my project. However it
wouldn't really be appropriate for going back into the standard
library because it spends most of its time having to subvert the
design and implementation of the existing classes.

However I was wondering if anyone was working on fixing the
(IMHO horrible) mess and wants any moral support?

Roger

Relevant Pages

  • RE: Support Code 0x80072F17
    ... > How do I disable any of the SSL connection between Exchange and PDA? ... > Anthony Capstick ...
    (microsoft.public.windows.server.sbs)
  • Re: RWW with no https
    ... I do not consider a:8080 a url that is appropriate for a SSL end user connection. ... So just so we are all clear, RWW HAS to go over HTTPS. ... Even if I do https but port 8080 would not matter ...
    (microsoft.public.windows.server.sbs)
  • Re: [Full-Disclosure] idea (quite a bit off-topic, but....)
    ... it is functionally equivilent to just opening a single connection. ... with the symmetric key you got from the server, and send it UDP to a fixed ... After a random number of packets, reconnect with ssl, assert the unique id ...
    (Full-Disclosure)
  • Re: SSL clients not working from Windows XP
    ... Determine If SSL Connectivity Is Not Working on the Web Server or on ... >>> To check your connection settings, click the Tools menu, ... >>> and then click Internet Options. ... >>> discover network connection settings. ...
    (microsoft.public.inetserver.iis.security)
  • Re: Entourage 2004 + SSL + load balancer = corrupt attachments
    ... Whenever we use SSL encryption ... The attachments are sent fine if a non-SSL connection ... Change the preferences in Entourage so that attachments are set to be ...
    (microsoft.public.mac.office.entourage)