pyopenssl-list — General discussion list for users and developers of pyOpenSSL

[pyOpenSSL] pyOpenSSL in Debian

[Sandro T. <mat...@gm...>]

Hi Jean-Paul,
I'm really happy that someone is now supporting again pyOpenSSL tool!
I maintain the Debian package for it, and I'll try to keep up with
your updates :)

Actually, I'm trying to get rid of latex2html to generate
documentation (we cannot use it for the Debian package since it's not
a completly free tool), replacing it with tex4ht; as soon as I'll have
a working patch, I'll submit to you.

Thanks for your work,
Sandro

-- 
Sandro Tosi (aka morph, Morpheus, matrixhasu)
My website: http://matrixhasu.altervista.org/
Me at Debian: http://wiki.debian.org/SandroTosi

Re: [pyOpenSSL] get_notBefore/get_notAfter

[George M. <ge...@no...>]

It works now!

Thanks for the quick fix.

Regards,
George McCollister

Jean-Paul Calderone wrote:
> On Tue, 25 Mar 2008 12:53:20 -0500, George McCollister <ge...@no...> wrote:
>   
>> I'm using 0.7a1 and get_notBefore and get_notAfter seem to be broken.
>> I've included some information below:
>>
>> Here is a snippet of my code:
>>
>>        cert = load_certificate(FILETYPE_PEM, buf)
>>        #print type(cert)
>>        if cert:
>>            key = cert.get_pubkey()
>>            key_type = 'none'
>>            if key.type() == TYPE_RSA:
>>                key_type = 'RSA'
>>            elif key.type() == TYPE_DSA:
>>                key_type = 'DSA'
>>            subject = cert.get_subject()
>>            issuer = cert.get_issuer()
>>
>>            expired = 'No'
>>            if cert.has_expired():
>>                expired = 'Yes'
>>
>>            notBefore = cert.get_notBefore()
>>            notAfter = cert.get_notAfter()
>>
>> Here is the error:
>>  [25/Mar/2008:17:40:28] HTTP Traceback (most recent call last):
>>  File "/usr/lib/python2.4/site-packages/cherrypy/_cprequest.py", line
>> 551, in respond
>>  cherrypy.response.body = self.handler()
>>  File "/usr/lib/python2.4/site-packages/cherrypy/_cpdispatch.py", line
>> 24, in __call__
>>  return self.callable(*self.args, **self.kwargs)
>>  File "/opt/WebUI/ui.py", line 691, in ViewKey
>>  key=self.getkeyinfo(keyname + '.crt')
>>  File "/opt/WebUI/ui.py", line 882, in getkeyinfo
>>  notBefore = cert.get_notBefore()
>>  Error: []
>>
>> System Information:
>>    linux 2.6.21.4
>>    arch: armeb-xscale
>>    python 2.4.2
>>    openssl-0.9.8f
>>
>>     
>
> Thanks.  I think I've fixed this.  I just released 0.7a2, which includes
> the fix.  Could you check to see if it works for you?
>
> Jean-Paul
>
> -------------------------------------------------------------------------
> This SF.net email is sponsored by: Microsoft
> Defy all challenges. Microsoft(R) Visual Studio 2008.
> http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
> _______________________________________________
> pyopenssl-list mailing list
> pyo...@li...
> https://lists.sourceforge.net/lists/listinfo/pyopenssl-list
>   

Re: [pyOpenSSL] get_notBefore/get_notAfter

[Jean-Paul C. <ex...@di...>]

On Tue, 25 Mar 2008 12:53:20 -0500, George McCollister <ge...@no...> wrote:
>I'm using 0.7a1 and get_notBefore and get_notAfter seem to be broken.
>I've included some information below:
>
>Here is a snippet of my code:
>
>        cert = load_certificate(FILETYPE_PEM, buf)
>        #print type(cert)
>        if cert:
>            key = cert.get_pubkey()
>            key_type = 'none'
>            if key.type() == TYPE_RSA:
>                key_type = 'RSA'
>            elif key.type() == TYPE_DSA:
>                key_type = 'DSA'
>            subject = cert.get_subject()
>            issuer = cert.get_issuer()
>
>            expired = 'No'
>            if cert.has_expired():
>                expired = 'Yes'
>
>            notBefore = cert.get_notBefore()
>            notAfter = cert.get_notAfter()
>
>Here is the error:
>  [25/Mar/2008:17:40:28] HTTP Traceback (most recent call last):
>  File "/usr/lib/python2.4/site-packages/cherrypy/_cprequest.py", line
>551, in respond
>  cherrypy.response.body = self.handler()
>  File "/usr/lib/python2.4/site-packages/cherrypy/_cpdispatch.py", line
>24, in __call__
>  return self.callable(*self.args, **self.kwargs)
>  File "/opt/WebUI/ui.py", line 691, in ViewKey
>  key=self.getkeyinfo(keyname + '.crt')
>  File "/opt/WebUI/ui.py", line 882, in getkeyinfo
>  notBefore = cert.get_notBefore()
>  Error: []
>
>System Information:
>    linux 2.6.21.4
>    arch: armeb-xscale
>    python 2.4.2
>    openssl-0.9.8f
>

Thanks.  I think I've fixed this.  I just released 0.7a2, which includes
the fix.  Could you check to see if it works for you?

Jean-Paul

[pyOpenSSL] get_notBefore/get_notAfter

[George M. <ge...@no...>]

I'm using 0.7a1 and get_notBefore and get_notAfter seem to be broken.
I've included some information below:

Here is a snippet of my code:

        cert = load_certificate(FILETYPE_PEM, buf)
        #print type(cert)
        if cert:
            key = cert.get_pubkey()
            key_type = 'none'
            if key.type() == TYPE_RSA:
                key_type = 'RSA'
            elif key.type() == TYPE_DSA:
                key_type = 'DSA'
            subject = cert.get_subject()
            issuer = cert.get_issuer()
           
            expired = 'No'
            if cert.has_expired():
                expired = 'Yes'
               
            notBefore = cert.get_notBefore()
            notAfter = cert.get_notAfter()

Here is the error:
  [25/Mar/2008:17:40:28] HTTP Traceback (most recent call last):
  File "/usr/lib/python2.4/site-packages/cherrypy/_cprequest.py", line
551, in respond
  cherrypy.response.body = self.handler()
  File "/usr/lib/python2.4/site-packages/cherrypy/_cpdispatch.py", line
24, in __call__
  return self.callable(*self.args, **self.kwargs)
  File "/opt/WebUI/ui.py", line 691, in ViewKey
  key=self.getkeyinfo(keyname + '.crt')
  File "/opt/WebUI/ui.py", line 882, in getkeyinfo
  notBefore = cert.get_notBefore()
  Error: []

System Information:
    linux 2.6.21.4
    arch: armeb-xscale
    python 2.4.2
    openssl-0.9.8f
   
Regards,
George McCollister

Re: [pyOpenSSL] Call for testing - pyOpenSSL 0.7a1

[Arnaud D. <arn...@fr...>]

Hi,

I am the author of those patches and I will try to document them this week.
Nevertheless, I already made a quick synopsis of each patch :
http://arnaud.desmons.free.fr/wordpress/?p=85
http://arnaud.desmons.free.fr/wordpress/?p=86

Nice to see that this code is useful for others ;-).
Regards,

-- 
Arnaud




Selon Sebastian Vieira <seb...@gm...>:

> Hi Jean-Paul,
>
> I would love to take credit for the patches, and provide you with the
> documentation you asked for. But the truth is that i haven't written these,
> and to be honest my knowledge of C is extremely limited so i'm unable to
> answer these questions. Sorry.
>
> kind regards,
>
> Sebastian
>
> On Sun, Mar 23, 2008 at 12:20 AM, Jean-Paul Calderone <ex...@di...>
> wrote:
>
> > On Sat, 22 Mar 2008 22:16:56 +0100, Sebastian Vieira <seb...@gm...>
> > wrote:
> > >Hi,
> > >
> > >Any chance of including the CRL patch found on http://tinyurl.com/2kj8o6?
> I
> > >found that the required pkcs12 patched cleanly against the 0.7 source,
> > but
> > >the crl patch failed one hunk:
> > >
> > >patching file src/crypto/crypto.c
> > >Hunk #1 succeeded at 461 (offset -1 lines).
> > >Hunk #2 succeeded at 591 (offset -1 lines).
> > >Hunk #3 succeeded at 626 (offset -1 lines).
> > >Hunk #4 succeeded at 794 (offset 25 lines).
> > >Hunk #5 FAILED at 803.
> > >Hunk #6 succeeded at 872 (offset 26 lines).
> > >
> > >I ask this because my python/openvpn script depends on it :)
> > >
> > >kind regards,
> > >
> >
> > Hey Sebastian,
> >
> > This is definitely a possibility.  I may need some help with it, though.
> >
> > First, http://arnaud.desmons.free.fr/pyOpenSSL-0.6-crl.patch is the patch
> > you're referring to, right?  And the patch which must be applied first is
> > http://arnaud.desmons.free.fr/pyOpenSSL-0.6-pkcs12.patch?
> >
> > If so, here are some specific questions the answers to which would help me
> > out a bunch:
> >
> >  * What is the proper usage of crypto_dump_pkcs12?
> >  * Is crypto_PKCS12_set_certificate stealing a reference (meaning memory
> > corruption will likely follow a call to it)?
> >  * Same question for crypto_PKCS12_set_privatekey.
> >  * Why the commented out lines in crypto_PKCS12_dealloc and in the
> > definition of crypto_PKCS12_Type?
> >
> >  * What is the proper usage of crypto_dump_crl?
> >
> > And more generally:
> >
> >  * Documentation would be greatly appreciated.  Either in the form of C
> >    comments in the code, or docstrings exposed to Python (instead of the
> >    empty strings currently given to the new APIs), or in LaTeX as diffs
> >    against doc/pyOpenSSL.tex
> >  * Unit tests would be even better. ;)
> >
> > In the mean time, I've applied both patches (resolving the simple
> > conflicts)
> > and pushed a branch to launchpad -
> >
>
https://code.launchpad.net/~exarkun/pyopenssl/pkcs12-crl<https://code.launchpad.net/%7Eexarkun/pyopenssl/pkcs12-crl>-
> in case you want
> > to use that diff (since it applies clean to trunk now) or if you want to
> > generate any patches.
> >
> > Jean-Paul
> >
>


-- 
Arnaud

Re: [pyOpenSSL] Call for testing - pyOpenSSL 0.7a1

[Sebastian V. <seb...@gm...>]

Hi Jean-Paul,

I would love to take credit for the patches, and provide you with the
documentation you asked for. But the truth is that i haven't written these,
and to be honest my knowledge of C is extremely limited so i'm unable to
answer these questions. Sorry.

kind regards,

Sebastian

On Sun, Mar 23, 2008 at 12:20 AM, Jean-Paul Calderone <ex...@di...>
wrote:

> On Sat, 22 Mar 2008 22:16:56 +0100, Sebastian Vieira <seb...@gm...>
> wrote:
> >Hi,
> >
> >Any chance of including the CRL patch found on http://tinyurl.com/2kj8o6? I
> >found that the required pkcs12 patched cleanly against the 0.7 source,
> but
> >the crl patch failed one hunk:
> >
> >patching file src/crypto/crypto.c
> >Hunk #1 succeeded at 461 (offset -1 lines).
> >Hunk #2 succeeded at 591 (offset -1 lines).
> >Hunk #3 succeeded at 626 (offset -1 lines).
> >Hunk #4 succeeded at 794 (offset 25 lines).
> >Hunk #5 FAILED at 803.
> >Hunk #6 succeeded at 872 (offset 26 lines).
> >
> >I ask this because my python/openvpn script depends on it :)
> >
> >kind regards,
> >
>
> Hey Sebastian,
>
> This is definitely a possibility.  I may need some help with it, though.
>
> First, http://arnaud.desmons.free.fr/pyOpenSSL-0.6-crl.patch is the patch
> you're referring to, right?  And the patch which must be applied first is
> http://arnaud.desmons.free.fr/pyOpenSSL-0.6-pkcs12.patch?
>
> If so, here are some specific questions the answers to which would help me
> out a bunch:
>
>  * What is the proper usage of crypto_dump_pkcs12?
>  * Is crypto_PKCS12_set_certificate stealing a reference (meaning memory
> corruption will likely follow a call to it)?
>  * Same question for crypto_PKCS12_set_privatekey.
>  * Why the commented out lines in crypto_PKCS12_dealloc and in the
> definition of crypto_PKCS12_Type?
>
>  * What is the proper usage of crypto_dump_crl?
>
> And more generally:
>
>  * Documentation would be greatly appreciated.  Either in the form of C
>    comments in the code, or docstrings exposed to Python (instead of the
>    empty strings currently given to the new APIs), or in LaTeX as diffs
>    against doc/pyOpenSSL.tex
>  * Unit tests would be even better. ;)
>
> In the mean time, I've applied both patches (resolving the simple
> conflicts)
> and pushed a branch to launchpad -
> https://code.launchpad.net/~exarkun/pyopenssl/pkcs12-crl<https://code.launchpad.net/%7Eexarkun/pyopenssl/pkcs12-crl>- in case you want
> to use that diff (since it applies clean to trunk now) or if you want to
> generate any patches.
>
> Jean-Paul
>

Re: [pyOpenSSL] Call for testing - pyOpenSSL 0.7a1

[Jean-Paul C. <ex...@di...>]

On Sat, 22 Mar 2008 22:16:56 +0100, Sebastian Vieira <seb...@gm...> wrote:
>Hi,
>
>Any chance of including the CRL patch found on http://tinyurl.com/2kj8o6 ? I
>found that the required pkcs12 patched cleanly against the 0.7 source, but
>the crl patch failed one hunk:
>
>patching file src/crypto/crypto.c
>Hunk #1 succeeded at 461 (offset -1 lines).
>Hunk #2 succeeded at 591 (offset -1 lines).
>Hunk #3 succeeded at 626 (offset -1 lines).
>Hunk #4 succeeded at 794 (offset 25 lines).
>Hunk #5 FAILED at 803.
>Hunk #6 succeeded at 872 (offset 26 lines).
>
>I ask this because my python/openvpn script depends on it :)
>
>kind regards,
>

Hey Sebastian,

This is definitely a possibility.  I may need some help with it, though.

First, http://arnaud.desmons.free.fr/pyOpenSSL-0.6-crl.patch is the patch
you're referring to, right?  And the patch which must be applied first is
http://arnaud.desmons.free.fr/pyOpenSSL-0.6-pkcs12.patch?

If so, here are some specific questions the answers to which would help me
out a bunch:

  * What is the proper usage of crypto_dump_pkcs12?
  * Is crypto_PKCS12_set_certificate stealing a reference (meaning memory corruption will likely follow a call to it)?
  * Same question for crypto_PKCS12_set_privatekey.
  * Why the commented out lines in crypto_PKCS12_dealloc and in the definition of crypto_PKCS12_Type?

  * What is the proper usage of crypto_dump_crl?

And more generally:

  * Documentation would be greatly appreciated.  Either in the form of C
    comments in the code, or docstrings exposed to Python (instead of the
    empty strings currently given to the new APIs), or in LaTeX as diffs
    against doc/pyOpenSSL.tex
  * Unit tests would be even better. ;)

In the mean time, I've applied both patches (resolving the simple conflicts)
and pushed a branch to launchpad - https://code.launchpad.net/~exarkun/pyopenssl/pkcs12-crl - in case you want
to use that diff (since it applies clean to trunk now) or if you want to
generate any patches.

Jean-Paul

Re: [pyOpenSSL] Call for testing - pyOpenSSL 0.7a1

[Sebastian V. <seb...@gm...>]

Hi,

Any chance of including the CRL patch found on http://tinyurl.com/2kj8o6 ? I
found that the required pkcs12 patched cleanly against the 0.7 source, but
the crl patch failed one hunk:

patching file src/crypto/crypto.c
Hunk #1 succeeded at 461 (offset -1 lines).
Hunk #2 succeeded at 591 (offset -1 lines).
Hunk #3 succeeded at 626 (offset -1 lines).
Hunk #4 succeeded at 794 (offset 25 lines).
Hunk #5 FAILED at 803.
Hunk #6 succeeded at 872 (offset 26 lines).

I ask this because my python/openvpn script depends on it :)

kind regards,

S.

On Sat, Mar 22, 2008 at 7:11 PM, <ex...@tw...> wrote:

> Greetings all,
>
> Over the past several weeks, I've been working on integrating patches from
> the issue tracker and fixing long-standing bugs in the 0.6 release.  I've
> gotten to the point where I think a release would be useful.  So I've put
> together an alpha of what will become 0.7.  You can find a source tarball
> or Windows Python 2.5 installers on the SourceForge download page.  Any
> testing and feedback anyone can provide would be greatly appreciated.
>  I'll
> probably aim for a final 0.7 release in between one to two weeks, barring
> any serious problems anyone may find.
>
> Thanks!
>
> Jean-Paul
>
> -------------------------------------------------------------------------
> This SF.net email is sponsored by: Microsoft
> Defy all challenges. Microsoft(R) Visual Studio 2008.
> http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
> _______________________________________________
> pyopenssl-list mailing list
> pyo...@li...
> https://lists.sourceforge.net/lists/listinfo/pyopenssl-list
>

[pyOpenSSL] Call for testing - pyOpenSSL 0.7a1

[<ex...@tw...>]

Greetings all,

Over the past several weeks, I've been working on integrating patches from
the issue tracker and fixing long-standing bugs in the 0.6 release.  I've
gotten to the point where I think a release would be useful.  So I've put
together an alpha of what will become 0.7.  You can find a source tarball
or Windows Python 2.5 installers on the SourceForge download page.  Any
testing and feedback anyone can provide would be greatly appreciated.  I'll
probably aim for a final 0.7 release in between one to two weeks, barring
any serious problems anyone may find.

Thanks!

Jean-Paul

[pyOpenSSL] unable to add X509 extension

[Sebastian V. <seb...@gm...>]

Hi,

(i really hope this list is still somewhat active)

Let me say that i'm totally new to python, so please excuse me for that :)
I have modified the simple example script somewhat to have it generate a
client certificate, signed by an existing CA certificate.

Now all works up to the point that i want to add an X509 extension. The
'Basic Constraints' extension works fine, but when i add another (or replace
it) like this:

extensions.append(crypto.X509Extension('basicConstraints',1, 'CA:true'))
extensions.append(crypto.X509Extension('nsComment', 0, 'OpenSSL Generated
Certificate'))
cert.add_extensions(extensions)


i get this error:

ValueError: Can't initialize exception

The same goes for

extensions.append(crypto.X509Extension('subjectKeyIdentifier', 0, 'hash'))


and authorityKeyIdentifier


Am i doing something fundamentally wrong? Is this feature not implemented,
or shouldn't i be using pyopenssl for this? I appreciate any feedback
because so far Google hasn't been helpful.

I'm using an deb package python-pyopenssl from Debian Lenny's repo. I've
also tried downloading the source and patching it with the "[ 1166109 ]
(re)enabling X509Extensions" patch found on the sourceforge website, but
this gives me the same error.

kind regards,

Sebastian

[pyOpenSSL] Patch to fix examples/simple

[Hugh E. <hug...@gm...>]

Hello All,

I've just added a patch to the SF.net tracker which fixes the examples
in examples/simple.  See patch #1874366
https://sourceforge.net/tracker/?func=detail&atid=401760&aid=1874366&group_id=31249

Regards,
Hugh

Re: [pyOpenSSL] CA signing question

[Arnaud D. <arn...@fr...>]

> I'm trying to use your pyOpenSSL python wrapper to sign a .csr with a CA
> cerificate, however I don't understand how your code works (most
> domcumentation seems to be written with a client-server perspective of
> ecrypting communication).
> 
> I could find the
> > static PyObject *
> > crypto_X509_sign(crypto_X509Obj *self, PyObject *args)
> function (which seems to be what I'm looking for), but I do not
> understand how to instantiate an X509 object - the
> load_certificate(type, buffer) method seems to be relevant, but I fail
> to supply it with the correct arguments...

Hi,

Here is the code I use in vulture-pki to sign a certificat.
This is a certificat object's method (nothing to deal with pyOpenSSL).

    def sign(self):
        req = crypto.X509Req()
        subj = req.get_subject()
        setattr(subj, 'CN', self.cn)
        setattr(subj, 'emailAddress', self.mail)
        setattr(subj, 'ST', self.st)
        setattr(subj, 'O', self.organisation)
        setattr(subj, 'C', self.country)
        pkey = crypto.PKey()
        pkey.generate_key(self.profile.key_type, self.profile.key_size)
        req.set_pubkey(pkey)
        req.sign(pkey, 'md5')
        self.pkey = crypto.dump_privatekey(crypto.FILETYPE_PEM, pkey)
        x509 = crypto.X509()
        x509.set_subject(req.get_subject())
        x509.set_pubkey(req.get_pubkey())
        cacert = crypto.load_certificate(crypto.FILETYPE_PEM, self.profile.ca_cert)
        cakey = crypto.load_privatekey(crypto.FILETYPE_PEM, self.profile.ca_key)
        x509.set_issuer(cacert.get_subject())
        x509.set_serial_number(self.id)
        x509.gmtime_adj_notBefore(0)
        delta = self.valid_until.date() - self.date.date();
        x509.gmtime_adj_notAfter(delta.days * 60 * 60 * 24)
        x509.sign(cakey, self.profile.digest)
        self.x509 = crypto.dump_certificate(crypto.FILETYPE_PEM, x509)


Hope it will help.
Regards,

-- 
Arnaud

[pyOpenSSL] CA signing question

[Tribaal <tr...@gm...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi List

I'm trying to use your pyOpenSSL python wrapper to sign a .csr with a CA
cerificate, however I don't understand how your code works (most
domcumentation seems to be written with a client-server perspective of
ecrypting communication).

I could find the
> static PyObject *
> crypto_X509_sign(crypto_X509Obj *self, PyObject *args)
function (which seems to be what I'm looking for), but I do not
understand how to instantiate an X509 object - the
load_certificate(type, buffer) method seems to be relevant, but I fail
to supply it with the correct arguments...

Could you please give me a quick pointer? I'll try to gather my
experience in a python script and will send it back to you to use it as
an example in case somebody else needs to sign a certificate with a CA.

Thank you very much for your help - I really appreciate it.

- - Trib'
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFHQwdpND4mi+cKVzQRAoSZAJ9c9u4TYxh0ZsA40o597DkNMkcZ6wCgjSEB
hr3qbxi0rDF8qghqfj/j+h8=
=Qfk0
-----END PGP SIGNATURE-----

[pyOpenSSL] TLS connection with pre shared key

[Abhishek T. <abh...@gm...>]

Hi Friends ,

        Can any body suppy me the source code of client and server for
setting up the TLS connetion using pre shared key.
        Any help or link on this , will great help for me . It's urgent.

        Thanks in advance!!!

Re: [pyOpenSSL] About pyopenssl

[xor e. <mak...@gm...>]

On 03:15 pm, da...@cr... wrote:
> >
> > >If you show me the C API calls you need, I'll see if they're actually
> > >in place. If they aren't, I can probably add them, or at least
> > >suggest how to.
> > >
> > >Dave.
>
>
Hi again i need the functions related with pkcs7 documents,i need them for:

   - sign pkcs7 documents with certificates
   - verify pkcs7 documents
   - decrypt pkcs 7 docs
   - control if the document i recieve is a valid pkcs7
   - extract the certificate(s),public keys from pkcs7 documents
   - control of the certificate chains -the trust of chain
   - some asn functions to parse the docs

If you have some of them or help me to write them i will be appreciated. I
have experience with C programming language but didnt write anything for a
long time. You may send me a format to obey when i write new functions which
also will be very helpful.

Bye have a nice day !

Re: [pyOpenSSL] About pyopenssl

[<gl...@di...>]

On 03:15 pm, da...@cr... wrote:
>On Mon Aug 20 14:47:29 2007, xor exor wrote:
>>Do you plan to add these ones to pyopenssl? I need the ones for
>>signature
>>verification with cert/pubkeys? My software will recieve some
>>signatures
>>with certificates and public keys. Therefore i need to verify them.
>
>If you show me the C API calls you need, I'll see if they're actually
>in place. If they aren't, I can probably add them, or at least
>suggest how to.
>
>Dave.

Just wanted to reiterate my support here for your fork.  Are you ready =

to become "the" pyopenssl, since the maintainer is completely AWOL and =

Twisted et. al. would be ready to point to it instead?  Have you talked =

to the Debian or Ubuntu guys about it?

Re: [pyOpenSSL] About pyopenssl

[Dave C. <da...@cr...>]

On Mon Aug 20 14:47:29 2007, xor exor wrote:
> Do you plan to add these ones to pyopenssl? I need the ones for 
> signature
> verification with cert/pubkeys? My software will recieve some 
> signatures
> with certificates and public keys. Therefore i need to verify them.

If you show me the C API calls you need, I'll see if they're actually 
in place. If they aren't, I can probably add them, or at least 
suggest how to.

Dave.
-- 
Dave Cridland - mailto:da...@cr... - xmpp:dw...@ja...
  - acap://acap.dave.cridland.net/byowner/user/dwd/bookmarks/
  - http://dave.cridland.net/
Infotrope Polymer - ACAP, IMAP, ESMTP, and Lemonade

Re: [pyOpenSSL] About pyopenssl

[xor e. <mak...@gm...>]

Do you plan to add these ones to pyopenssl? I need the ones for signature
verification with cert/pubkeys? My software will recieve some signatures
with certificates and public keys. Therefore i need to verify them. If your
edition doesnt have them im going to write them if it is not a very
difficult job ofcourse :)

Re: [pyOpenSSL] About pyopenssl

[Dave C. <da...@cr...>]

On Mon Aug 20 13:16:52 2007, xor exor wrote:
> Hi that module is not finished yet isnt it?Bacause the c version of 
> ssl has
> more functions than that python one. Do you know a more updated 
> version, or
> is it easy to extend it with C ?

I have an updated fork at 
http://svn.dave.cridland.net/svn/projects/pyopenssl/dwd/ that has 
substantial additions.

Which parts of the C API were you missing?

Dave.
-- 
Dave Cridland - mailto:da...@cr... - xmpp:dw...@ja...
  - acap://acap.dave.cridland.net/byowner/user/dwd/bookmarks/
  - http://dave.cridland.net/
Infotrope Polymer - ACAP, IMAP, ESMTP, and Lemonade

[pyOpenSSL] About pyopenssl

[xor e. <mak...@gm...>]

Hi that module is not finished yet isnt it?Bacause the c version of ssl has
more functions than that python one. Do you know a more updated version, or
is it easy to extend it with C ?

[pyOpenSSL] using public key in a pem certificate

[Luke <sec...@gm...>]

Using pyopenssl, is there any way to use the public key found in a pem
formatted certificate?

I see ways to load private keys from pem certificates, but is there any
way to load and use a public key?

Re: [pyOpenSSL] X509 Extension Bug

[Dave C. <da...@cr...>]

On Mon May  7 06:19:32 2007, Eli Collins wrote:
> I just wanted to draw your attention to a bug in the X509 Extension 
> class
> which debian has applied a patch for, but seems to be missing
> from Dave's svn fork as of r709.

Sorry, going through old mail and I noticed I'd put this one aside to 
deal with and forgotten all about it.

This is applied in my r752.

Anyone volunteering to test? If I can get enough testing of r752, 
then I could call it 0.7, and start asking for volunteers for 
packaging et al.

Dave.
-- 
Dave Cridland - mailto:da...@cr... - xmpp:dw...@ja...
  - acap://acap.dave.cridland.net/byowner/user/dwd/bookmarks/
  - http://dave.cridland.net/
Infotrope Polymer - ACAP, IMAP, ESMTP, and Lemonade

[pyOpenSSL] Build problem, pyopenssl on win32 vs2003.

[Darrin T. <dar...@gm...>]

I've been trying to build pyOpenSSL on Windows with Visual Studio
2003 (command line tools). I've hit the message below:

building 'OpenSSL.SSL' extension
creating build\temp.win32-2.5\Release\src\ssl
C:\Program Files\Microsoft Visual Studio .NET 2003\Vc7\bin\cl.exe /c
/nologo /Ox /MD /W3 /GX /DNDEBUG -Ic:\OpenSSL\include
-Ic:\Python25\include -Ic:\Python25\PC /Tcsrc/ssl/connection.c
/Fobuild\temp.win32-2.5\Release\src/ssl/connection.obj
connection.c
c:\cygwin\home\pandora\build-toolchain\build\pyOpenSSL-0.6\src\crypto\x509name.h(27)
: error C2059: syntax error : '('
c:\cygwin\home\pandora\build-toolchain\build\pyOpenSSL-0.6\src\crypto\x509name.h(30)
: error C2059: syntax error : '}'
c:\OpenSSL\include\openssl\x509v3.h(185) : error C2059: syntax error : '('
c:\OpenSSL\include\openssl\x509v3.h(193) : error C2059: syntax error : 'type'
c:\OpenSSL\include\openssl\x509v3.h(197) : error C2059: syntax error : '}'

I dug in and looked at preprocessor output. For some reason, after
winsock.h is included, X509_NAME is replaced with ((LPCSTR) 7).

Oh, And I'm building against the windows binaries provided by "shining
light productions".

Any ideas on how to fix this?

--
Darrin

Re: [pyOpenSSL] setup/install

[Dave C. <da...@cr...>]

On Tue Jun 12 15:51:21 2007, Nancy Head wrote:
> setup.py build_ext -I ...\openssl\inc32 -L 
> ...\openssl\out32dllsetup.py build
> 
> 
C:\Program Files\Python24\python.exe setup.py [...]

That way it'll bypass whatever association you have set up, and "just 
run". You *may* find this works better.

> So... next step is to download/install the following?
> 
>   .NET Framework Version 2.0 Redistributable Package
> 
> &  .NET Framework Version 2.0 Software Development Kit

I don't think you need .NET to install pyOpenSSL with a normal 
Python. (You'd possibly need it for a .NET hosted Python, but that's 
a different thing).

I'm away from home, and therefore a convenient Windows VM, but I'll 
take a look when I get back.

Dave.
-- 
Dave Cridland - mailto:da...@cr... - xmpp:dw...@ja...
  - acap://acap.dave.cridland.net/byowner/user/dwd/bookmarks/
  - http://dave.cridland.net/
Infotrope Polymer - ACAP, IMAP, ESMTP, and Lemonade

[pyOpenSSL] setup/install

[Nancy H. <ecl...@gm...>]

I've downloaded pyOpenSSL and am looking at the doc, but need some basic
help getting set up.

I'm on Win and have unzipped files to C:\Program Files\Python24\pyOpenSSL-
0.6

::::::::::::The doc says::::::::::::::::
2.2 Building the library:

 setup.py build_ext -I ...\openssl\inc32 -L ...\openssl\out32dllsetup.py build

Where ...\openssl is of course the location of your OpenSSL installation.

:::::::::::::::::::::::::::::::::::::::::::::::

Here's what I've done to try to do that... Any
suggestions/corrections/direction very welcome.

I opened a cmd prompt, navigated to the pyOpenSSL-0.6 dir and typed...

     setup.py build_ext -I C:\Program Files\Python24\openssl\inc32 -L
C:\Program Files\Python24\openssl\out32dll

This launched PythonWin and opened setup.py. Oh yeah, I have it defaulting
there (but am not sure how to change it to launch Python by default.)

So, I tried using Run (to execute setup.py) and typing in the args there...

   build_ext -I openssl\inc32 -L openssl\out32dll

This produced output "running build_ext" and an error message:

... returned an exit code error: The .NET Framework SDK needs to be
installed.

So... next step is to download/install the following?

   .NET Framework Version 2.0 Redistributable Package

&  .NET Framework Version 2.0 Software Development Kit

Thanks...

Nancy