python - 在 Python/Tornado 中处理非 SSL 流量

Question

我有一个在使用 SSL 的 python 2.7.10/Tornado 中运行的网络服务。当通过非 SSL 调用时，此服务会抛出错误 ( http://.. .)。

我不希望在未使用 SSL 时访问我的服务，但我希望以更简洁的方式处理它。

这是我在 SSL 上运行良好的主要代码:

if __name__ == "__main__":
    tornado.options.parse_command_line()
    #does not work on 2.7.6
    ssl_ctx = ssl.create_default_context(ssl.Purpose.CLIENT_AUTH)
    ssl_ctx.load_cert_chain("...crt.pem","...key.pem")
    ssl_ctx.load_verify_locations("...CA.crt.pem")
    http_server = tornado.httpserver.HTTPServer(application, ssl_options=ssl_ctx, decompress_request=True)
    http_server.listen(options.port)

    mainloop = tornado.ioloop.IOLoop.instance()

    print("Main Server started on port XXXX")
    mainloop.start()

这是我使用 http://... 而不是 https://... 访问该服务器时的错误:

[E 151027 20:45:57 http1connection:700] Uncaught exception
Traceback (most recent call last):
  File "/usr/local/lib/python2.7/dist-packages/tornado/http1connection.py", line 691, in _server_request_loop
    ret = yield conn.read_response(request_delegate)
  File "/usr/local/lib/python2.7/dist-packages/tornado/gen.py", line 807, in run
    value = future.result()
  File "/usr/local/lib/python2.7/dist-packages/tornado/concurrent.py", line 209, in result
    raise_exc_info(self._exc_info)
  File "/usr/local/lib/python2.7/dist-packages/tornado/gen.py", line 810, in run
    yielded = self.gen.throw(*sys.exc_info())
  File "/usr/local/lib/python2.7/dist-packages/tornado/http1connection.py", line 166, in _read_message
    quiet_exceptions=iostream.StreamClosedError)
  File "/usr/local/lib/python2.7/dist-packages/tornado/gen.py", line 807, in run
    value = future.result()
  File "/usr/local/lib/python2.7/dist-packages/tornado/concurrent.py", line 209, in result
    raise_exc_info(self._exc_info)
  File "<string>", line 3, in raise_exc_info
SSLError: [SSL: HTTP_REQUEST] http request (_ssl.c:590) 

我应该如何处理该异常有什么想法吗？

当我捕获到对仅支持 SSL 的 API 的非 SSL 调用时，符合标准的返回值是什么？

更新

此 API 在特定端口上运行，例如https://example.com:1234/。我想通知尝试不使用 SSL 进行连接的用户，例如http://example.com:1234/通过返回错误消息或状态代码来证明他们所做的是不正确的。因为它是未捕获的异常返回 500，他们可以将其解释为我的编程错误。有什么想法吗？

Answer 1

有一个 excelent discussion in this Tornado issue关于那个，在哪里Tornado maintainer说:

If you have both HTTP and HTTPS in the same tornado process, you must be running two separate HTTPServers (of course such a feature should not be tied to whether SSL is handled at the tornado level, since you could be terminating SSL in a proxy, but since your question stipulated that SSL was enabled in tornado let's focus on this case first). You could simply give the HTTP server a different Application, one that just does this redirect.

因此，最好的解决方案是监听端口 80 且未设置 ssl_options 参数的 HTTPServer。

更新

对 https://example.com/some/path 的请求将转到端口 443，您必须在该端口配置一个 HTTPServer 来处理 https 流量；而对 http://example.com/some/path 的请求将转到端口 80，您必须在该端口有另一个没有 ssl 选项的 HTTPServer 实例，这是您必须返回自定义响应的地方你想要的代码。那不应该引发任何错误。