TLS va HTTPS

import os
import ssl
import socket
import subprocess
import tempfile
import threading

ish = tempfile.mkdtemp()
kalit = os.path.join(ish, "kalit.pem")
sert = os.path.join(ish, "sert.pem")

# O'zi imzolagan sertifikat yasaymiz (faqat sinov uchun!)
subprocess.run([
    "openssl", "req", "-x509", "-newkey", "rsa:2048",
    "-keyout", kalit, "-out", sert, "-days", "1", "-nodes",
    "-subj", "/CN=localhost",
], check=True, capture_output=True)

print("sertifikat yasaldi:", os.path.exists(sert))
print("kalit yasaldi     :", os.path.exists(kalit))

PORT = 9900

tinglovchi = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
tinglovchi.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
tinglovchi.bind(("127.0.0.1", PORT))
tinglovchi.listen(1)

server_ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
server_ctx.load_cert_chain(sert, kalit)


def server():
    xom, _ = tinglovchi.accept()
    with server_ctx.wrap_socket(xom, server_side=True) as himoyalangan:
        himoyalangan.recv(1024)
        himoyalangan.sendall(b"shifrlangan javob")


oqim = threading.Thread(target=server, daemon=True)
oqim.start()

# Mijoz: o'zi imzolagan sertifikatga ishonishi uchun uni beramiz
mijoz_ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
mijoz_ctx.load_verify_locations(sert)

xom = socket.create_connection(("127.0.0.1", PORT))
s = mijoz_ctx.wrap_socket(xom, server_hostname="localhost")
s.sendall(b"shifrlangan so'rov")
javob = s.recv(1024)

print()
print("TLS 1.3 ishlatildimi:", s.version() == "TLSv1.3")
print("shifr tanlandimi    :", s.cipher() is not None)

sertifikat = s.getpeercert()
nom = dict(x[0] for x in sertifikat["subject"])
print("sertifikat egasi    :", nom["commonName"])

print("javob               :", javob.decode())

s.close()
oqim.join()
tinglovchi.close()

import os
import ssl
import socket
import subprocess
import tempfile
import threading

ish = tempfile.mkdtemp()
kalit = os.path.join(ish, "k.pem")
sert = os.path.join(ish, "s.pem")
subprocess.run([
    "openssl", "req", "-x509", "-newkey", "rsa:2048",
    "-keyout", kalit, "-out", sert, "-days", "1", "-nodes",
    "-subj", "/CN=localhost",
], check=True, capture_output=True)

PORT = 9901
tinglovchi = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
tinglovchi.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
tinglovchi.bind(("127.0.0.1", PORT))
tinglovchi.listen(4)

server_ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
server_ctx.load_cert_chain(sert, kalit)


def server(nechta):
    for _ in range(nechta):
        xom, _ = tinglovchi.accept()
        try:
            with server_ctx.wrap_socket(xom, server_side=True) as h:
                h.recv(64)
                h.sendall(b"ok")
        except ssl.SSLError:
            pass          # mijoz qo'l berishni rad etdi
        except OSError:
            pass


oqim = threading.Thread(target=server, args=(3,), daemon=True)
oqim.start()


def sinab_kor(nom, ctx, xost="localhost"):
    try:
        xom = socket.create_connection(("127.0.0.1", PORT), timeout=5)
        s = ctx.wrap_socket(xom, server_hostname=xost)
        s.sendall(b"salom")
        s.recv(64)
        s.close()
        print(f"  {nom:<34} ULANDI")
    except ssl.SSLCertVerificationError as x:
        sabab = x.verify_message.split(",")[0]
        print(f"  {nom:<34} RAD ETILDI")
        print(f"  {'':<34} sabab: {sabab}")
    except ssl.SSLError:
        print(f"  {nom:<34} RAD ETILDI: TLS xatosi")


print("uchta mijoz, uchta sozlama:")

# 1 - tizimning ishonchli markazlari (bizning sertifikat yo'q)
sinab_kor("tizim ishonchi bilan", ssl.create_default_context())

# 2 - sertifikatimizni ishonchli deb ko'rsatamiz
ctx2 = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
ctx2.load_verify_locations(sert)
sinab_kor("sertifikat ishonchli deb berildi", ctx2)

# 3 - to'g'ri sertifikat, lekin NOM mos kelmaydi
ctx3 = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
ctx3.load_verify_locations(sert)
sinab_kor("nom mos kelmaydi", ctx3, "boshqa-sayt.uz")

oqim.join()
tinglovchi.close()

MALUMOTLAR = [
    ("Qaysi IP manzilga ulandingiz", False),
    ("Qaysi portga ulandingiz", False),
    ("Ulanish vaqti va davomiyligi", False),
    ("Uzatilgan ma'lumot HAJMI", False),
    ("Sayt nomi (SNI, qo'l berishda)", False),
    ("DNS so'rovi (oddiy DNS da)", False),
    ("So'ralgan yo'l (/hisobim)", True),
    ("Sarlavhalar va cookie lar", True),
    ("Forma va parol", True),
    ("Javob tanasi", True),
    ("Holat kodi", True),
]

print(f"{'Ma\'lumot':<34} {'Yo\'lda ko\'rinadimi'}")
print("-" * 56)
for nom, shifrlangan in MALUMOTLAR:
    holat = "yo'q - shifrlangan" if shifrlangan else "HA - ochiq"
    print(f"{nom:<34} {holat}")

ochiq = sum(1 for _, s in MALUMOTLAR if not s)
print()
print("ochiq qoladigan bandlar:", ochiq)
print("shifrlanadiganlari     :", len(MALUMOTLAR) - ochiq)
print()
print("TLS mazmunni yashiradi, ALOQA FAKTINI emas")