pyopenssl-list — General discussion list for users and developers of pyOpenSSL

[pyOpenSSL] potential memory leak

[Adrian M. <ad...@co...>]

I found a potential memory leak in flush_error_queue@util.c  using 
Py_DECREF macro with a function call inside. Since macros expand its 
argument n times ( as Py_DECREF does, where n > 1 ) this call could be 
generated n times. In this case error_queue_to_list allocates a PyList 
object and transfer the ownership of the pointer to the caller function.

Im attaching a simple patch

cheers

a/

[pyOpenSSL] ANN: eGenix pyOpenSSL Distribution 0.8.0-0.9.8j-1

[eGenix T. M.-A. L. <in...@eg...>]

________________________________________________________________________

ANNOUNCING

                   eGenix.com pyOpenSSL Distribution

                        Version 0.8.0-0.9.8j-1


             An easy to install and use repackaged distribution
               of the pyOpenSSL Python interface for OpenSSL -
                  available on Windows and Unix platforms


This announcement is also available on our web-site for online reading:
http://www.egenix.com/company/news/eGenix-pyOpenSSL-Distribution-0.8.0-0.9.8j-1-GA.html

________________________________________________________________________

INTRODUCTION

The eGenix.com pyOpenSSL Distribution includes everything you need to
get started with SSL in Python. It comes with an easy to use installer
that includes the most recent OpenSSL library versions in pre-compiled
form.

pyOpenSSL is an open-source Python add-on (http://pyopenssl.sf.net/)
that allows writing SSL aware networking applications as well as
certificate management tools.

OpenSSL is an open-source implementation of the SSL protocol
(http://www.openssl.org/).

For more information, please see the product page:

    http://www.egenix.com/products/python/pyOpenSSL/

________________________________________________________________________

NEWS

This fourth release of the eGenix.com pyOpenSSL Distribution upgrades
the included OpenSSL libs to version 0.9.8j, which fixes a vulnerability
found in earlier OpenSSL releases of the 0.9.8 branch: CVE-2008-5077
(http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5077).

We have also enabled zlib compression support in OpenSSL for both the
Linux and Windows builds, so OpenSSL client/servers can now negotiate
on-the-fly zlib compression for SSL connections.

Binaries are available for Linux x86 and x64 as well as Windows x86
and include pyOpenSSL 0.8.0 as well as pre-compiled and tested
OpenSSL 0.9.8j libraries.

________________________________________________________________________

DOWNLOADS

The download archives and instructions for installing the package can
be found at:

    http://www.egenix.com/products/python/pyOpenSSL/

________________________________________________________________________

UPGRADING

Before installing this version of pyOpenSSL, please make sure that
you uninstall any previously installed pyOpenSSL version. Otherwise,
you could end up not using the included OpenSSL libs.

_______________________________________________________________________

SUPPORT

Commercial support for these packages is available from eGenix.com.
Please see

    http://www.egenix.com/services/support/

for details about our support offerings.

Enjoy,
-- 
Marc-Andre Lemburg
eGenix.com

Professional Python Services directly from the Source  (#1, Jan 30 2009)
>>> Python/Zope Consulting and Support ...        http://www.egenix.com/
>>> mxODBC.Zope.Database.Adapter ...             http://zope.egenix.com/
>>> mxODBC, mxDateTime, mxTextTools ...        http://python.egenix.com/
________________________________________________________________________

::: Try our new mxODBC.Connect Python Database Interface for free ! ::::


   eGenix.com Software, Skills and Services GmbH  Pastor-Loeh-Str.48
    D-40764 Langenfeld, Germany. CEO Dipl.-Math. Marc-Andre Lemburg
           Registered at Amtsgericht Duesseldorf: HRB 46611
               http://www.egenix.com/company/contact/

Re: [pyOpenSSL] Problems with openssl-0.9.8j

[Jean-Paul C. <ex...@di...>]

On Sun, 18 Jan 2009 14:19:31 +0100, Christian Scharkus <mai...@go...> wrote:
>Thanks for your help but what is the integer value of OP_NO_TICKET?
>Currently I've got pyopenssl 0.8 only and have no idea where to get
>the dev-source and I don't think the user of the app should have to
>install it either.

exarkun@boson:~/Scratch/Sources/openssl-0.9.8j$ grep OP_NO_TICKET ./ -r  | grep '#define'
./include/openssl/ssl.h:#define SSL_OP_NO_TICKET                    0x00004000L

Jean-Paul

Re: [pyOpenSSL] Problems with openssl-0.9.8j

[Christian S. <mai...@go...>]

Thanks for your help but what is the integer value of OP_NO_TICKET?
Currently I've got pyopenssl 0.8 only and have no idea where to get
the dev-source and I don't think the user of the app should have to
install it either.

greetings
Christian Scharkus

>>Hi folks :)
>>
>>I use Arch Linux i686 with pyopenssl-0.8 and openssl-0.9.8j and have got
>>some problems with connecting to kekz.net:23002.
>>
>>http://codepad.org/2aad1eAI
>>
>>$ python
>>Python 2.6.1 (r261:67515, Dec  7 2008, 08:27:41)
>>[GCC 4.3.2] on linux2
>>Type "help", "copyright", "credits" or "license" for more information.
>>>>> import socket
>>>>> from OpenSSL.SSL import SSLv3_METHOD, Connection, Context
>>>>> s = socket.socket()
>>>>> conn = Connection(Context(SSLv3_METHOD), s)
>>>>> conn.connect(('kekz.net',23002))
>>>>> conn.do_handshake()
>>Traceback (most recent call last):
>>
>>  File "<stdin>", line 1, in <module>
>>OpenSSL.SSL.Error: [('SSL routines', 'SSL3_GET_RECORD', 'wrong version number')]
>
> This seems to be due to the change in OpenSSL 0.9.8j to sending a TLS
> extension section by default.  A correct SSL server will ignore this
> section, but it seems there are a few SSL libraries which freak out
> when they encounter this.
>
> The next version of pyOpenSSL will include a way to work around this
> by exposing a constant to explicitly disable sending this TLS extension
> section.
>
> This is done with a Context option, so if your example code above were
> changed to set up the connection like this:
>
>    from OpenSSL.SSL import OP_NO_TICKET
>    ctx = Context(SSLv3_METHOD)
>    ctx.set_options(OP_NO_TICKET)
>    conn = Connection(ctx, s)
>
> Then it would work (I've tested this against trunk@HEAD of pyOpenSSL and
> OpenSSL 0.9.8j and it fixed the connection problem for me).
>
> You can probably also just use the value of OP_NO_TICKET with older versions
> of pyOpenSSL.  It will have the same effect on OpenSSL 0.9.8j and no effect
> at all on older versions.
>
> Jean-Paul

Re: [pyOpenSSL] Problems with openssl-0.9.8j

[Jean-Paul C. <ex...@di...>]

On Sun, 18 Jan 2009 00:45:43 +0100, Christian Scharkus <mai...@go...> wrote:
>Hi folks :)
>
>I use Arch Linux i686 with pyopenssl-0.8 and openssl-0.9.8j and have got
>some problems with connecting to kekz.net:23002.
>
>http://codepad.org/2aad1eAI
>
>$ python
>Python 2.6.1 (r261:67515, Dec  7 2008, 08:27:41)
>[GCC 4.3.2] on linux2
>Type "help", "copyright", "credits" or "license" for more information.
>>>> import socket
>>>> from OpenSSL.SSL import SSLv3_METHOD, Connection, Context
>>>> s = socket.socket()
>>>> conn = Connection(Context(SSLv3_METHOD), s)
>>>> conn.connect(('kekz.net',23002))
>>>> conn.do_handshake()
>Traceback (most recent call last):
>
>  File "<stdin>", line 1, in <module>
>OpenSSL.SSL.Error: [('SSL routines', 'SSL3_GET_RECORD', 'wrong version number')]

This seems to be due to the change in OpenSSL 0.9.8j to sending a TLS
extension section by default.  A correct SSL server will ignore this
section, but it seems there are a few SSL libraries which freak out
when they encounter this.

The next version of pyOpenSSL will include a way to work around this
by exposing a constant to explicitly disable sending this TLS extension
section.

This is done with a Context option, so if your example code above were
changed to set up the connection like this:

    from OpenSSL.SSL import OP_NO_TICKET
    ctx = Context(SSLv3_METHOD)
    ctx.set_options(OP_NO_TICKET)
    conn = Connection(ctx, s)

Then it would work (I've tested this against trunk@HEAD of pyOpenSSL and
OpenSSL 0.9.8j and it fixed the connection problem for me).

You can probably also just use the value of OP_NO_TICKET with older versions
of pyOpenSSL.  It will have the same effect on OpenSSL 0.9.8j and no effect
at all on older versions.

Jean-Paul

[pyOpenSSL] Problems with openssl-0.9.8j

[Christian S. <mai...@go...>]

Hi folks :)

I use Arch Linux i686 with pyopenssl-0.8 and openssl-0.9.8j and have got
some problems with connecting to kekz.net:23002.

http://codepad.org/2aad1eAI

$ python
Python 2.6.1 (r261:67515, Dec  7 2008, 08:27:41)
[GCC 4.3.2] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import socket
>>> from OpenSSL.SSL import SSLv3_METHOD, Connection, Context
>>> s = socket.socket()
>>> conn = Connection(Context(SSLv3_METHOD), s)
>>> conn.connect(('kekz.net',23002))
>>> conn.do_handshake()
Traceback (most recent call last):

  File "<stdin>", line 1, in <module>
OpenSSL.SSL.Error: [('SSL routines', 'SSL3_GET_RECORD', 'wrong version number')]

It works fine with openssl-0.9.8i or when I use SSLv23_METHOD as Context but
this seems not to work with my twisted-based app.

Thanks
Christian Scharkus

[pyOpenSSL] test

[Taras P. I. <nap...@gm...>]

-- 
Тарас Иващенко (Taras Ivashchenko), OSCP
www.securityaudit.ru
----
"Software is like sex: it's better when it's free." - Linus Torvalds

[pyOpenSSL] How to read information from X509v3 extensions of certificate using pyOpenSSL?

[Taras P. I. <nap...@gm...>]

Hello, list!

I use pyopenssl for checking SSL certificates.
And one of such checks is if given certificate is self-signed.
I can do it using values of X509v3 extensions: the subject key identifier and
the authority key id:
X509v3 Subject Key Identifier:
	    0E:D4:AA:B1:09:91:7C:36:60:EA:56:4E:9C:57:00:AF:9C:4D:02:00
X509v3 Authority Key Identifier:
	    keyid:0E:D4:AA:B1:09:91:7C:36:60:EA:56:4E:9C:57:00:AF:9C:4D:02:00

I read documentation of pyOpenSSL but I didn't find way how to grub this information 
from certificate using, for example, methods of X509 object.

-- 
Тарас Иващенко (Taras Ivashchenko), OSCP
www.securityaudit.ru
----
"Software is like sex: it's better when it's free." - Linus Torvalds

[pyOpenSSL] ANN: eGenix pyOpenSSL Distribution 0.8.0-0.9.8i-1

[eGenix T. M.-A. L. <in...@eg...>]

________________________________________________________________________

ANNOUNCING

                   eGenix.com pyOpenSSL Distribution

                        Version 0.8.0-0.9.8i-1


             An easy to install and use repackaged distribution
               of the pyOpenSSL Python interface for OpenSSL -
                  available on Windows and Unix platforms


This announcement is also available on our web-site for online reading:
http://www.egenix.com/company/news/eGenix-pyOpenSSL-Distribution-0.8.0-0.9.8i-1-GA.html

________________________________________________________________________

INTRODUCTION

The eGenix.com pyOpenSSL Distribution includes everything you need to
get started with SSL in Python. It comes with an easy to use installer
that includes the most recent OpenSSL library versions in pre-compiled
form.

pyOpenSSL is an open-source Python add-on (http://pyopenssl.sf.net/)
that allows writing SSL aware networking applications as well as
certificate management tools.

OpenSSL is an open-source implementation of the SSL protocol
(http://www.openssl.org/).

For more information, please see the product page:

    http://www.egenix.com/products/python/pyOpenSSL/

________________________________________________________________________

NEWS

This third release of the eGenix.com pyOpenSSL Distribution upgrades
pyOpenSSL to version 0.8, which includes a few bug fixes related to
threading.

Please note that OpenSSL, the underlying SSL engine, does not allow
sharing connections between threads. This is a little known fact which
could in the past cause pyOpenSSL to crash Python. Jean-Paul Calderone,
the maintainer of pyOpenSSL, has added fixes in 0.8 to prevent those
crashes.

We have also fixed several compiler warnings found in the code. The
version of pyOpenSSL you find in the source release has those patches
applied.

Binaries are available for Linux x86 and x64 as well as Windows x86 and
include pyOpenSSL 0.8.0 as well as the OpenSSL 0.9.8i libraries.

________________________________________________________________________

DOWNLOADS

The download archives and instructions for installing the package can
be found at:

    http://www.egenix.com/products/python/pyOpenSSL/

________________________________________________________________________

UPGRADING

Before installing this version of pyOpenSSL, please make sure that
you uninstall any previously installed pyOpenSSL version. Otherwise,
you could end up not using the included OpenSSL libs.

_______________________________________________________________________

SUPPORT

Commercial support for these packages is available from eGenix.com.
Please see

    http://www.egenix.com/services/support/

for details about our support offerings.

Enjoy,
-- 
Marc-Andre Lemburg
eGenix.com

Professional Python Services directly from the Source  (#1, Dec 19 2008)
>>> Python/Zope Consulting and Support ...        http://www.egenix.com/
>>> mxODBC.Zope.Database.Adapter ...             http://zope.egenix.com/
>>> mxODBC, mxDateTime, mxTextTools ...        http://python.egenix.com/
________________________________________________________________________
2008-12-02: Released mxODBC.Connect 1.0.0      http://python.egenix.com/

::: Try our new mxODBC.Connect Python Database Interface for free ! ::::


   eGenix.com Software, Skills and Services GmbH  Pastor-Loeh-Str.48
    D-40764 Langenfeld, Germany. CEO Dipl.-Math. Marc-Andre Lemburg
           Registered at Amtsgericht Duesseldorf: HRB 46611
               http://www.egenix.com/company/contact/

[pyOpenSSL] Validating server certificate with CAcert

[Marco da S. <mar...@gm...>]

Hy all!

I''ve just started using OpenSSL and Python-OpenSSL in the past days for a project in my university.

I have a client-server app, and the server has a cert that is used to cypher the communication between client-server. (clients have no cert)

My question is, how can I validate the server cert with the CA cert ? I'm a bit lost with this, I already found how to do it directly with OpenSSL in the shell, but how do I do this in python-openssl?

This is my socket creation code, hope its ok.

Server Socket :

        self.context = SSL.Context(SSL.SSLv3_METHOD)
        self.context.use_privatekey_file('key.pem')
        self.context.use_certificate_file('cert.pem')
        self.server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        self.server = SSL.Connection(self.context, self.server)
        self.server.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)

Client socket :

            self.sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            self.ctx = SSL.Context(SSL.SSLv3_METHOD)
            self.ctx.set_verify(SSL.VERIFY_NONE, verify_cb)
            self.sock = SSL.Connection(self.ctx,self.sock)
            self.sock.connect((self.host, self.port))


Thanks all

Marco da Silva

Re: [pyOpenSSL] Basic CSR signing issues...

[Joshua 'j. G. <lis...@fl...>]

Bingo! After setting these dates, everything worked perfectly. Thanks
for your help!

-jag

On Tue, Nov 4, 2008 at 8:54 AM, Jean-Paul Calderone <ex...@di...> wrote:
> On Mon, 3 Nov 2008 16:25:55 -0500, Joshua 'jag' Ginsberg <lis...@fl...> wrote:
>>(apologies if this ends up double-posting -- I sent this 5 hours ago
>>and it hasn't shown up in the archives yet, so I'm not sure it went
>>out at all...)
>>
>>What am I doing wrong? Why can't I load my cert back into PyOpenSSL?
>>
>
> I'm not certain, but I suspect the issue is that you didn't explicitly set
> the notBefore and notAfter attributes on the certificate.  I'm not sure
> why the OpenSSL.crypto.Error doesn't provide this information, but if you
> run this openssl command line:
>
>    openssl x509 -in my.crt -text
>
> then this error is produced:
>
>    unable to load certificate
>    13042:error:0D07209B:asn1 encoding routines:ASN1_get_object:too long:asn1_lib.c:142:
>    13042:error:0D068066:asn1 encoding routines:ASN1_CHECK_TLEN:bad object header:tasn_dec.c:1281:
>    13042:error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error:tasn_dec.c:208:Type=ASN1_TIME
>    13042:error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error:tasn_dec.c:749:Field=notBefore, Type=X509_VAL
>    13042:error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error:tasn_dec.c:749:Field=validity, Type=X509_CINF
>    13042:error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error:tasn_dec.c:749:Field=cert_info, Type=X509
>    13042:error:0906700D:PEM routines:PEM_ASN1_read_bio:ASN1 lib:pem_oth.c:83:
>
> It's similar to the one you get from pyOpenSSL (complaining about a "too
> long" ASN1 thing somewhere, with lots of nesting and such) but notice that
> it also includes the names of the fields which were on the parse stack at
> the time of the error, something omitted from the pyOpenSSL exception.  Once
> I noticed that, I checked your code and saw that you weren't setting the
> validity dates, hence my suspicion.
>
> Jean-Paul
>
> -------------------------------------------------------------------------
> This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
> Build the coolest Linux based applications with Moblin SDK & win great prizes
> Grand prize is a trip for two to an Open Source event anywhere in the world
> http://moblin-contest.org/redirect.php?banner_id=100&url=/
> _______________________________________________
> pyopenssl-list mailing list
> pyo...@li...
> https://lists.sourceforge.net/lists/listinfo/pyopenssl-list
>

Re: [pyOpenSSL] Basic CSR signing issues...

[Jean-Paul C. <ex...@di...>]

On Mon, 3 Nov 2008 16:25:55 -0500, Joshua 'jag' Ginsberg <lis...@fl...> wrote:
>(apologies if this ends up double-posting -- I sent this 5 hours ago
>and it hasn't shown up in the archives yet, so I'm not sure it went
>out at all...)
>
>What am I doing wrong? Why can't I load my cert back into PyOpenSSL?
>

I'm not certain, but I suspect the issue is that you didn't explicitly set
the notBefore and notAfter attributes on the certificate.  I'm not sure
why the OpenSSL.crypto.Error doesn't provide this information, but if you
run this openssl command line:

    openssl x509 -in my.crt -text

then this error is produced:

    unable to load certificate
    13042:error:0D07209B:asn1 encoding routines:ASN1_get_object:too long:asn1_lib.c:142:
    13042:error:0D068066:asn1 encoding routines:ASN1_CHECK_TLEN:bad object header:tasn_dec.c:1281:
    13042:error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error:tasn_dec.c:208:Type=ASN1_TIME
    13042:error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error:tasn_dec.c:749:Field=notBefore, Type=X509_VAL
    13042:error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error:tasn_dec.c:749:Field=validity, Type=X509_CINF
    13042:error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error:tasn_dec.c:749:Field=cert_info, Type=X509
    13042:error:0906700D:PEM routines:PEM_ASN1_read_bio:ASN1 lib:pem_oth.c:83:

It's similar to the one you get from pyOpenSSL (complaining about a "too
long" ASN1 thing somewhere, with lots of nesting and such) but notice that
it also includes the names of the fields which were on the parse stack at
the time of the error, something omitted from the pyOpenSSL exception.  Once
I noticed that, I checked your code and saw that you weren't setting the
validity dates, hence my suspicion.

Jean-Paul

Re: [pyOpenSSL] Basic CSR signing issues...

[Wouter v. B. <wou...@gm...>]

Hi Joshua,

You might have a look at bug 274418, https://bugs.launchpad.net/bugs/274418.

However this bug is only relevant if you are able to import certificates
that you created and signed on the commandline with e.g. openssl.

Using the openssl ASN1 dump option on the 'failing' certificate might also
give some insight on what is going on. If you are not sure post the dump on
the list.

regards,

Wouter

2008/11/3 Joshua 'jag' Ginsberg <lis...@fl...>

> (apologies if this ends up double-posting -- I sent this 5 hours ago
> and it hasn't shown up in the archives yet, so I'm not sure it went
> out at all...)
>
> What am I doing wrong? Why can't I load my cert back into PyOpenSSL?
>
> Python 2.5.2 (r252:60911, Sep 29 2008, 21:10:35)
> [GCC 4.3.2] on linux2
> Type "help", "copyright", "credits" or "license" for more information.
> >>> from OpenSSL import crypto
> >>> pkey = crypto.PKey()
> >>> pkey.generate_key(crypto.TYPE_RSA, 1024)
> >>> open('/tmp/my.key',
> 'w').write(crypto.dump_privatekey(crypto.FILETYPE_PEM, pkey))
> >>> req = crypto.X509Req()
> >>> subject = req.get_subject()
> >>> subject.CN = 'secure.example.com'
> >>> subject.C = 'US'
> >>> subject.ST = 'MA'
> >>> subject.L = 'Boston'
> >>> subject.O = 'Bitchin Carrot, LLC'
> >>> subject.OU = 'Department of Belgian Waffles'
> >>> subject.emailAddress = 'cer...@ex...'
> >>> req.set_pubkey(pkey)
> >>> req.sign(pkey, 'sha1')
> >>> open('/tmp/my.csr',
> 'w').write(crypto.dump_certificate_request(crypto.FILETYPE_PEM, req))
> >>> ca_crt_pem = open('/tmp/ca.crt').read()
> >>> ca_crt = crypto.load_certificate(crypto.FILETYPE_PEM, ca_crt_pem)
> >>> ca_key_pem = open('/tmp/ca.key').read()
> >>> ca_key = crypto.load_privatekey(crypto.FILETYPE_PEM, ca_key_pem)
> >>> cert = crypto.X509()
> >>> cert.set_serial_number(1)
> >>> cert.set_issuer(ca_crt.get_subject())
> >>> cert.set_subject(req.get_subject())
> >>> cert.set_pubkey(req.get_pubkey())
> >>> cert.sign(ca_key, 'sha1')
> >>>
> open('/tmp/my.crt','w').write(crypto.dump_certificate(crypto.FILETYPE_PEM,
> cert))
> >>> fail_cert_obj = crypto.load_certificate(crypto.FILETYPE_PEM,
> open('/tmp/my.crt').read())
> Traceback (most recent call last):
>  File "<stdin>", line 1, in <module>
> OpenSSL.crypto.Error: [('asn1 encoding routines', 'ASN1_get_object',
> 'too long'), ('asn1 encoding routines', 'ASN1_CHECK_TLEN', 'bad object
> header'), ('asn1 encoding routines', 'ASN1_ITEM_EX_D2I', 'nested asn1
> error'), ('asn1 encoding routines', 'ASN1_TEMPLATE_NOEXP_D2I', 'nested
> asn1 error'), ('asn1 encoding routines', 'ASN1_TEMPLATE_NOEXP_D2I',
> 'nested asn1 error'), ('asn1 encoding routines',
> 'ASN1_TEMPLATE_NOEXP_D2I', 'nested asn1 error'), ('PEM routines',
> 'PEM_ASN1_read_bio', 'ASN1 lib')]
>
> -------------------------------------------------------------------------
> This SF.Net email is sponsored by the Moblin Your Move Developer's
> challenge
> Build the coolest Linux based applications with Moblin SDK & win great
> prizes
> Grand prize is a trip for two to an Open Source event anywhere in the world
> http://moblin-contest.org/redirect.php?banner_id=100&url=/
> _______________________________________________
> pyopenssl-list mailing list
> pyo...@li...
> https://lists.sourceforge.net/lists/listinfo/pyopenssl-list
>

[pyOpenSSL] Basic CSR signing issues...

[Joshua 'j. G. <lis...@fl...>]

What am I doing wrong? Why can't I load my cert back into PyOpenSSL?

Python 2.5.2 (r252:60911, Sep 29 2008, 21:10:35)
[GCC 4.3.2] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> from OpenSSL import crypto
>>> pkey = crypto.PKey()
>>> pkey.generate_key(crypto.TYPE_RSA, 1024)
>>> open('/tmp/my.key', 'w').write(crypto.dump_privatekey(crypto.FILETYPE_PEM, pkey))
>>> req = crypto.X509Req()
>>> subject = req.get_subject()
>>> subject.CN = 'secure.example.com'
>>> subject.C = 'US'
>>> subject.ST = 'MA'
>>> subject.L = 'Boston'
>>> subject.O = 'Bitchin Carrot, LLC'
>>> subject.OU = 'Department of Belgian Waffles'
>>> subject.emailAddress = 'cer...@ex...'
>>> req.set_pubkey(pkey)
>>> req.sign(pkey, 'sha1')
>>> open('/tmp/my.csr', 'w').write(crypto.dump_certificate_request(crypto.FILETYPE_PEM, req))
>>> ca_crt_pem = open('/tmp/ca.crt').read()
>>> ca_crt = crypto.load_certificate(crypto.FILETYPE_PEM, ca_crt_pem)
>>> ca_key_pem = open('/tmp/ca.key').read()
>>> ca_key = crypto.load_privatekey(crypto.FILETYPE_PEM, ca_key_pem)
>>> cert = crypto.X509()
>>> cert.set_serial_number(1)
>>> cert.set_issuer(ca_crt.get_subject())
>>> cert.set_subject(req.get_subject())
>>> cert.set_pubkey(req.get_pubkey())
>>> cert.sign(ca_key, 'sha1')
>>> open('/tmp/my.crt','w').write(crypto.dump_certificate(crypto.FILETYPE_PEM, cert))
>>> fail_cert_obj = crypto.load_certificate(crypto.FILETYPE_PEM, open('/tmp/my.crt').read())
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
OpenSSL.crypto.Error: [('asn1 encoding routines', 'ASN1_get_object',
'too long'), ('asn1 encoding routines', 'ASN1_CHECK_TLEN', 'bad object
header'), ('asn1 encoding routines', 'ASN1_ITEM_EX_D2I', 'nested asn1
error'), ('asn1 encoding routines', 'ASN1_TEMPLATE_NOEXP_D2I', 'nested
asn1 error'), ('asn1 encoding routines', 'ASN1_TEMPLATE_NOEXP_D2I',
'nested asn1 error'), ('asn1 encoding routines',
'ASN1_TEMPLATE_NOEXP_D2I', 'nested asn1 error'), ('PEM routines',
'PEM_ASN1_read_bio', 'ASN1 lib')]

[pyOpenSSL] Basic CSR signing issues...

[Joshua 'j. G. <lis...@fl...>]

(apologies if this ends up double-posting -- I sent this 5 hours ago
and it hasn't shown up in the archives yet, so I'm not sure it went
out at all...)

What am I doing wrong? Why can't I load my cert back into PyOpenSSL?

Python 2.5.2 (r252:60911, Sep 29 2008, 21:10:35)
[GCC 4.3.2] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> from OpenSSL import crypto
>>> pkey = crypto.PKey()
>>> pkey.generate_key(crypto.TYPE_RSA, 1024)
>>> open('/tmp/my.key', 'w').write(crypto.dump_privatekey(crypto.FILETYPE_PEM, pkey))
>>> req = crypto.X509Req()
>>> subject = req.get_subject()
>>> subject.CN = 'secure.example.com'
>>> subject.C = 'US'
>>> subject.ST = 'MA'
>>> subject.L = 'Boston'
>>> subject.O = 'Bitchin Carrot, LLC'
>>> subject.OU = 'Department of Belgian Waffles'
>>> subject.emailAddress = 'cer...@ex...'
>>> req.set_pubkey(pkey)
>>> req.sign(pkey, 'sha1')
>>> open('/tmp/my.csr', 'w').write(crypto.dump_certificate_request(crypto.FILETYPE_PEM, req))
>>> ca_crt_pem = open('/tmp/ca.crt').read()
>>> ca_crt = crypto.load_certificate(crypto.FILETYPE_PEM, ca_crt_pem)
>>> ca_key_pem = open('/tmp/ca.key').read()
>>> ca_key = crypto.load_privatekey(crypto.FILETYPE_PEM, ca_key_pem)
>>> cert = crypto.X509()
>>> cert.set_serial_number(1)
>>> cert.set_issuer(ca_crt.get_subject())
>>> cert.set_subject(req.get_subject())
>>> cert.set_pubkey(req.get_pubkey())
>>> cert.sign(ca_key, 'sha1')
>>> open('/tmp/my.crt','w').write(crypto.dump_certificate(crypto.FILETYPE_PEM, cert))
>>> fail_cert_obj = crypto.load_certificate(crypto.FILETYPE_PEM, open('/tmp/my.crt').read())
Traceback (most recent call last):
 File "<stdin>", line 1, in <module>
OpenSSL.crypto.Error: [('asn1 encoding routines', 'ASN1_get_object',
'too long'), ('asn1 encoding routines', 'ASN1_CHECK_TLEN', 'bad object
header'), ('asn1 encoding routines', 'ASN1_ITEM_EX_D2I', 'nested asn1
error'), ('asn1 encoding routines', 'ASN1_TEMPLATE_NOEXP_D2I', 'nested
asn1 error'), ('asn1 encoding routines', 'ASN1_TEMPLATE_NOEXP_D2I',
'nested asn1 error'), ('asn1 encoding routines',
'ASN1_TEMPLATE_NOEXP_D2I', 'nested asn1 error'), ('PEM routines',
'PEM_ASN1_read_bio', 'ASN1 lib')]

Re: [pyOpenSSL] PKCS7 and extracting certs

[Morgan R. <mor...@gm...>]

On Tue, Oct 21, 2008 at 2:14 AM, Scott Simpson
<sco...@ra...> wrote:
> I have a bunch of PKCS7 certificates that i can pull apart with the
> openssl command line app, but when i load them with pyOpenSSL i just
> get a PKCS7 object with only a few methods, none which allow me to
> extract the certificates.  Is there a way to get the certs from that
> object?

Currently the implementation of pyOpenSSL is essentially only geared
for working with SSL connections (as opposed to certificate
management), there's some development in other areas too but none that
I know of relating specifically to PKCS7.

What exactly are you trying to do?

Morgan

[pyOpenSSL] PKCS7 and extracting certs

[Scott S. <sco...@ra...>]

I have a bunch of PKCS7 certificates that i can pull apart with the  
openssl command line app, but when i load them with pyOpenSSL i just  
get a PKCS7 object with only a few methods, none which allow me to  
extract the certificates.  Is there a way to get the certs from that  
object?

Thanks!


Confidentiality Notice: This e-mail message (including any attached or
embedded documents) is intended for the exclusive and confidential use of the
individual or entity to which this message is addressed, and unless otherwise
expressly indicated, is confidential and privileged information of Rackspace.
Any dissemination, distribution or copying of the enclosed material is prohibited.
If you receive this transmission in error, please notify us immediately by e-mail
at ab...@ra..., and delete the original message.
Your cooperation is appreciated.

[pyOpenSSL] stunnel in pyopenssl

[Andres R. <and...@gm...>]

List,

    Hi! I'm a complete pyopenssl newbie, so bare with me please =)

    I'm looking for a project, code snippet, or something to get me
started in the writing of a "stunnel clone" with python + pyopenssl.
What I'm trying to do is not a complete stunnel port,but just one of
the use cases:

    SSL client <----> pyopenssl <----> non-ssl capable server

    Anyone has ideas, experiences, or a link to show me how this is
done using pyopenssl?

Cheers,
-- 
Andres Riancho
http://w3af.sourceforge.net/
Web Application Attack and Audit Framework

Re: [pyOpenSSL] Unit tests

[Morgan R. <mor...@gm...>]

On Sat, Oct 18, 2008 at 12:33 AM, Jean-Paul Calderone
<ex...@di...> wrote:
> The code you included looks right.  I would certainly expect two tests
> to be run, test_construction and test_generate_key, if I ran a command
> like "trial OpenSSL.test.test_crypto.RSATests", after doing the needed
> song and dance to get the code and tests into a state where they could
> be imported.

Still no joy, I've written a couple of further tests and none of them
are running (except test_construction as previously).

========================
.....
testPlaintext = "testing"
.....
class RSATests(TestCase, _Python23TestCaseHelper):
    .....

    def test_public_encrypt(self):
        """
        L{public_encrypt} generates a new key and encrypts a static value with
        the public key, then decrypts it with the private and compare the
        result
        """
        bits = 1024
        rsaobj = RSA()
        rsaobj.generate_key(bits)
        crypt = rsaobj.public_encrypt(testPlaintext)
        decrypt = rsaobj.private_decrypt(crypt)
        self.assertEqual(decrypt, testPlaintext)

    def test_private_encrypt(self):
        """
        L{private_encrypt} generates a new key and encrypts a static value with
        the private key, then decrypts it with the public and compares
the
        result
        """
        bits = 1024
        rsaobj = RSA()
        rsaobj.generate_key(bits)
        crypt = rsaobj.private_encrypt(testPlaintext)
        decrypt = rsaobj.public_decrypt(crypt)
        self.assertEqual(decrypt, testPlaintext)

========================

This is the script I'm using to execute the tests
========================
#!/bin/sh
python setup.py install --prefix=/tmp/pyOpenSSL-test
PYTHONPATH=/tmp/pyOpenSSL-test/lib/python2.5/site-packages/:$PYTHONPATH
python -c 'import OpenSSL; print OpenSSL'
PYTHONPATH=/tmp/pyOpenSSL-test/lib/python2.5/site-packages/:$PYTHONPATH
trial OpenSSL
========================

And the output
========================
  .....
    test_rsaGeneration ...                                                 [OK]
  RSATests
    test_construction ...                                                  [OK]
  X509NameTests
  .....
========================

Any suggestions would be greatly appreciated, I've pushed the latest
revision if anybody wants to look at the code in situ

Thanks,

Morgan

Re: [pyOpenSSL] Unit tests

[Jean-Paul C. <ex...@di...>]

On Sat, 18 Oct 2008 00:07:29 +1100, Morgan Reed <mor...@gm...> wrote:
>I've started writing unit tests for my additions now, I've got an
>issue though, I've updated test_crypto.py changes summarised below;
>
>================================================
>
>from OpenSSL.crypto import RSA, RSAType
>
>...
>
>class RSATests(TestCase, _Python23TestCaseHelper):
>
>    def test_construction(self):
>        """
>        L{RSA} takes no arguments and returns an instance of L{RSAType}.
>        """
>        rsaobj = RSA()
>        self.assertTrue(
>            isinstance(rsaobj, RSAType),
>            "%r is of type %r, should be %r" % (rsaobj,
>                                                type(rsaobj),
>                                                RSAType))
>
>    def test_generate_key(self):
>        """
>        L{generate_key} generates a new RSA key the given size and stores it in
>        the internal structure
>        """
>        bits = 1024
>        rsaobj = RSA()
>        rsaobj.generate_key(bits)
>        self.assertEqual(rsaobj.key_bits(), bits)
>
>================================================
>
>When I execute the tests only test_construction is being executed (or
>it's the only one appearing in the log), is there anything I need to
>do besides defining the test method in the test class? (apologies for
>the basic questions, I've never done automated unit testing in python
>before)
>

The code you included looks right.  I would certainly expect two tests
to be run, test_construction and test_generate_key, if I ran a command
like "trial OpenSSL.test.test_crypto.RSATests", after doing the needed
song and dance to get the code and tests into a state where they could
be imported.

Jean-Paul

[pyOpenSSL] Unit tests

[Morgan R. <mor...@gm...>]

I've started writing unit tests for my additions now, I've got an
issue though, I've updated test_crypto.py changes summarised below;

================================================

from OpenSSL.crypto import RSA, RSAType

...

class RSATests(TestCase, _Python23TestCaseHelper):

    def test_construction(self):
        """
        L{RSA} takes no arguments and returns an instance of L{RSAType}.
        """
        rsaobj = RSA()
        self.assertTrue(
            isinstance(rsaobj, RSAType),
            "%r is of type %r, should be %r" % (rsaobj,
                                                type(rsaobj),
                                                RSAType))

    def test_generate_key(self):
        """
        L{generate_key} generates a new RSA key the given size and stores it in
        the internal structure
        """
        bits = 1024
        rsaobj = RSA()
        rsaobj.generate_key(bits)
        self.assertEqual(rsaobj.key_bits(), bits)

================================================

When I execute the tests only test_construction is being executed (or
it's the only one appearing in the log), is there anything I need to
do besides defining the test method in the test class? (apologies for
the basic questions, I've never done automated unit testing in python
before)

Thanks,

Morgan

Re: [pyOpenSSL] Patch submission process

[Jean-Paul C. <ex...@di...>]

On Thu, 16 Oct 2008 23:33:40 +1100, Morgan Reed <mor...@gm...> wrote:
>On Thu, Oct 16, 2008 at 10:24 PM, Jean-Paul Calderone
><ex...@di...> wrote:
>> Cool.  Looking forward to it. :)
>
>Branch is now up on launchpad (mr-RSAadditions), haven't completed the
>unit tests yet, they'll have to wait until tomorrow.
>
>With regards to the unit tests, how do I go about executing them?
>

Any xUnit runner should do.  I use Twisted's `trial´.  Unfortunately the
repository layout is not friendly to unit testing (re-arranging it is on
my todo list), so you have to actually install your development version
in order to test it.  I typically install it to a scratch directory.  eg,

$ python setup.py install --prefix /tmp/pyOpenSSL-test
...
$ PYTHONPATH=/tmp/pyOpenSSL-test/lib/python2.5/site-packages/:$PYTHONPATH python -c 'import OpenSSL; print OpenSSL'
<module 'OpenSSL' from '/tmp/pyOpenSSL-test/lib/python2.5/site-packages/OpenSSL/__init__.pyc'>
$ PYTHONPATH=/tmp/pyOpenSSL-test/lib/python2.5/site-packages/:$PYTHONPATH trial OpenSSL
...
PASSED (successes=36)
$

Jean-Paul

Re: [pyOpenSSL] Patch submission process

[Morgan R. <mor...@gm...>]

On Thu, Oct 16, 2008 at 10:24 PM, Jean-Paul Calderone
<ex...@di...> wrote:
> Cool.  Looking forward to it. :)

Branch is now up on launchpad (mr-RSAadditions), haven't completed the
unit tests yet, they'll have to wait until tomorrow.

With regards to the unit tests, how do I go about executing them?

Re: [pyOpenSSL] Patch submission process

[Jean-Paul C. <ex...@di...>]

On Thu, 16 Oct 2008 21:52:06 +1100, Morgan Reed <mor...@gm...> wrote:
>On Thu, Oct 16, 2008 at 12:21 PM, Jean-Paul Calderone
><ex...@di...> wrote:
>> Patches attached to tickets in Launchpad are good.  bzr branches are also
>> good.  Changes with unit tests and documentation are best. :)
>
>No worries, is there a preferred patch format? (just give me a GNU
>diff commandline ;oD )

diff -u, please. :)

>I've done the doco, I'll do unit tests for what I have so far shortly.
>
>I'll look at putting a branch up on launchpad.
>

Cool.  Looking forward to it. :)

Jean-Paul

Re: [pyOpenSSL] Patch submission process

[Morgan R. <mor...@gm...>]

On Thu, Oct 16, 2008 at 12:21 PM, Jean-Paul Calderone
<ex...@di...> wrote:
> Patches attached to tickets in Launchpad are good.  bzr branches are also
> good.  Changes with unit tests and documentation are best. :)

No worries, is there a preferred patch format? (just give me a GNU
diff commandline ;oD )

I've done the doco, I'll do unit tests for what I have so far shortly.

I'll look at putting a branch up on launchpad.

Thanks