pyopenssl-list — General discussion list for users and developers of pyOpenSSL

Re: [pyOpenSSL] Patch submission process

[Jean-Paul C. <ex...@di...>]

On Thu, 16 Oct 2008 12:16:34 +1100, Morgan Reed <mor...@gm...> wrote:
>Hi all,
>
>       I've been working on extending the PyOpenSSL bindings to
>accommodate my needs over the past week or so, essentially building an
>interface to some of the low-level RSA functions.
>
>Thus far I've wrapped RSA_generate_key RSA_public_encrypt,
>RSA_private_encrypt, RSA_public_decrypt, RSA_private_decrypt, I'm
>planning completing my RSA_sign and RSA_verify wrappers in the next
>couple of days.
>
>Just wondering how I should go about submitting the new files an
>required patches (I'm extending the 0.8a1 codebase).
>

Patches attached to tickets in Launchpad are good.  bzr branches are also
good.  Changes with unit tests and documentation are best. :)

Jean-Paul

[pyOpenSSL] Patch submission process

[Morgan R. <mor...@gm...>]

Hi all,

       I've been working on extending the PyOpenSSL bindings to
accommodate my needs over the past week or so, essentially building an
interface to some of the low-level RSA functions.

Thus far I've wrapped RSA_generate_key RSA_public_encrypt,
RSA_private_encrypt, RSA_public_decrypt, RSA_private_decrypt, I'm
planning completing my RSA_sign and RSA_verify wrappers in the next
couple of days.

Just wondering how I should go about submitting the new files an
required patches (I'm extending the 0.8a1 codebase).

Thanks,

Morgan Reed

Re: [pyOpenSSL] CRL patch to stable?

[<arn...@fr...>]

Hi,

I updated PKCS12 patch for being doc/memory compliant with the main branch but not yet for CRL patch.

Regards,

-- 
Arnaud


----- Mail Original -----
De: "Sebastian Vieira" <seb...@gm...>
À: pyo...@li...
Envoyé: Mardi 30 Septembre 2008 11:38:23 GMT +01:00 Amsterdam / Berlin / Berne / Rome / Stockholm / Vienne
Objet: [pyOpenSSL] CRL patch to stable?



Hi, 

Some time ago i wrote to say someone made a nice patch for pyOpenSSL that was able to create certificate revocation lists (CRL). This patch was then added to another branch but never made it back into stable/main. Since i like to have CRL option and all the features/bugfixes of the now-main branch, could both be merged? 

kind regards, 

Sebastian 

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
pyopenssl-list mailing list
pyo...@li...
https://lists.sourceforge.net/lists/listinfo/pyopenssl-list

Re: [pyOpenSSL] CRL patch to stable?

[Jean-Paul C. <ex...@di...>]

On Tue, 30 Sep 2008 11:38:23 +0200, Sebastian Vieira <seb...@gm...> wrote:
>Hi,
>
>Some time ago i wrote to say someone made a nice patch for pyOpenSSL that
>was able to create certificate revocation lists (CRL). This patch was then
>added to another branch but never made it back into stable/main. Since i
>like to have CRL option and all the features/bugfixes of the now-main
>branch, could both be merged?
>

I still haven't had an opportunity to do the necessary remaining work to
get the CRL code into a shape where I'm comfortable having it in trunk.

I need to review the code and write unit tests and documentation.  Any help
anyone would like to provide in this would be much appreciated. :)

Jean-Paul

[pyOpenSSL] CRL patch to stable?

[Sebastian V. <seb...@gm...>]

Hi,

Some time ago i wrote to say someone made a nice patch for pyOpenSSL that
was able to create certificate revocation lists (CRL). This patch was then
added to another branch but never made it back into stable/main. Since i
like to have CRL option and all the features/bugfixes of the now-main
branch, could both be merged?

kind regards,

Sebastian

Re: [pyOpenSSL] Patch to add a certificate request version

[Jean-Paul C. <ex...@di...>]

On Thu, 25 Sep 2008 11:15:16 +0200, Wouter van Bommel <wou...@gm...> wrote:
>L.S.,
>
>As attachment I send a small patch wich adds an extra function to the
>library in order to set a version on an X509Req object.
>
>Some CA's require the precense of this (required) field, which is missing
>when exporting the object.
>
>The call X509Req.set_version() allows the ability to add the version.
>
>Regards,
>
>Wouter van Bommel
>

Hi Wouter,

Can you file a ticket at <http://launchpad.net/pyopenssl> and attach your
patch there?  If you could also include unit tests, documentation, or both
this would greatly reduce the work I need to do to apply it (and so speed
that up :).

Thanks!

Jean-Paul

[pyOpenSSL] Patch to add a certificate request version

[Wouter v. B. <wou...@gm...>]

diff -ru pyOpenSSL-0.6.org/src/crypto/x509req.c pyOpenSSL-0.6/src/crypto/x509req.c
--- pyOpenSSL-0.6.org/src/crypto/x509req.c      2002-09-05 09:49:22.000000000 +0200
+++ pyOpenSSL-0.6/src/crypto/x509req.c  2008-09-25 10:53:18.000000000 +0200
@@ -221,6 +221,30 @@
     return Py_None;
 }

+static char crypto_X509Req_set_version_doc[] = "\n\
+Add extensions to the request.\n\
+\n\
+Arguments: self - X509Req object\n\
+           args - The Python argument tuple, should be:\n\
+             version - The version numer (usually 0)\n\
+Returns:   None\n\
+";
+
+static PyObject *
+crypto_X509Req_set_version(crypto_X509ReqObj *self, PyObject *args)
+{
+    long version;
+
+    if (!PyArg_ParseTuple(args, "l:version", &version))
+        return NULL;
+
+    if (!X509_REQ_set_version(self->x509_req, version))
+        return NULL;
+
+    Py_INCREF(Py_None);
+    return Py_None;
+}
+
 /*
  * ADD_METHOD(name) expands to a correct PyMethodDef declaration
  *   {  'name', (PyCFunction)crypto_X509Req_name, METH_VARARGS }
@@ -236,6 +260,7 @@
     ADD_METHOD(sign),
     ADD_METHOD(verify),
     ADD_METHOD(add_extensions),
+    ADD_METHOD(set_version),
     { NULL, NULL }
 };
 #undef ADD_METHOD

Re: [pyOpenSSL] PyOpenSSL Linux 32/64 bit problem

[Jean-Paul C. <ex...@di...>]

On Tue, 23 Sep 2008 21:31:23 -0700 (PDT), Pravin Sinha <pks...@ya...> wrote:
>Hi,
>
>PyOpenSSL, built on 32 bit Linux does not work on 64 bit Linux and vice-versa. I have a requirement where I should be able to share the lib built on one machine(either 32bit or 64 bit, whichever works) to work with both. Any Idea if I can achieve  this.
>
>The error which I am getting while importing OpenSSL in python is:
>
>>>> import OpenSSL
>Traceback (most recent call last):
>  File "<stdin>", line 1, in ?
>  File "/test/OpenSSL/__init__.py", line 11, in ?
>    import rand, crypto, SSL, tsafe
>ImportError: /test/OpenSSL/rand.so: cannot open shared object file: No such file or directory
>_____________________________________________________________________
>
>Appreciate your time and help
>Regards,
>-Pravin.
>

I don't think this is an issue unique to pyOpenSSL.  This is how ELF shared
objects work.  I looked around a bit to try to find some documentation on a
way to build a combined 32/64 bit ELF library but I didn't find much.  I'm
not even sure it's possible; you may want to investigate that further.  If
you can figure out how to do it, then you can try building pyOpenSSL's
extension modules manually however is appropriate.  `setup.py build_ext´
allows a little customization, but I suspect not enough for this.

Jean-Paul

[pyOpenSSL] PyOpenSSL Linux 32/64 bit problem

[Pravin S. <pks...@ya...>]

Hi,

PyOpenSSL, built on 32 bit Linux does not work on 64 bit Linux and vice-versa. I have a requirement where I should be able to share the lib built on one machine(either 32bit or 64 bit, whichever works) to work with both. Any Idea if I can achieve  this.

The error which I am getting while importing OpenSSL in python is:

>>> import OpenSSL
Traceback (most recent call last):
  File "<stdin>", line 1, in ?
  File "/test/OpenSSL/__init__.py", line 11, in ?
    import rand, crypto, SSL, tsafe
ImportError: /test/OpenSSL/rand.so: cannot open shared object file: No such file or directory
_____________________________________________________________________

Appreciate your time and help
Regards,
-Pravin.




      

[pyOpenSSL] 0.8a1 is out

[Jean-Paul C. <ex...@di...>]

Hello,

I've just uploaded 0.8a1 to sourceforge.  This release is almost entirely about thread-related fixes.  It includes part of a patch Red Hat has been applying to their 0.6 package for a long time, as well as a change to the way OpenSSL.SSL.Connection manage the GIL.  Whereas previously Connection operations acquired and released the GIL as necessary to allow for concurrency, using a Connection object in multiple threads was not safe.  This should now be safe, through a combination of proper initialization of OpenSSL's threading support and a different strategy for managing the CPython GIL.

Please try it out and let me know how it goes.  Thanks!

Jean-Paul

Re: [pyOpenSSL] Getting the next cert in hierarchy

[Sebastian G. <seb...@gm...>]

Get_subject was the key to it, not get_issuer. ofcourse J

 

Best regards,

Seb

 

 

Fra: Sebastian Greatful [mailto:seb...@gm...] 
Sendt: 20. september 2008 12:55
Til: pyo...@li...
Emne: Getting the next cert in hierarchy

 

As part of my verification I'm trying to retrieve the email embedded in the
certificate. However it returns None

 

I'm using the code below where _verify is the callback pass as the second
argument to the set_verify method of a context object.

Judging from this, http://89.150.104.27/~snot/certificate.PNG, screenshot it
seems like I need to get the second certificate in the certificate
hierarchy. but how do I access it?

 

31         def _verify(self, conn, cert, errno, depth, retcode):

 

<snip />

 

38                 print cert.get_issuer().emailAddress

 39                 self.accessRights.read = True

 40                 self.accessRights.write = True

 41                 return retcode

 

Best regards,

Seb

 

[pyOpenSSL] Getting the next cert in hierarchy

[Sebastian G. <seb...@gm...>]

As part of my verification I'm trying to retrieve the email embedded in the
certificate. However it returns None

 

I'm using the code below where _verify is the callback pass as the second
argument to the set_verify method of a context object.

Judging from this, http://89.150.104.27/~snot/certificate.PNG, screenshot it
seems like I need to get the second certificate in the certificate
hierarchy. but how do I access it?

 

31         def _verify(self, conn, cert, errno, depth, retcode):

 

<snip />

 

38                 print cert.get_issuer().emailAddress

 39                 self.accessRights.read = True

 40                 self.accessRights.write = True

 41                 return retcode

 

Best regards,

Seb

 

Re: [pyOpenSSL] How can I verify client that the client is signed by me?

[Sebastian G. <seb...@gm...>]

Thanks to Jean-Paul I now know that the problem wasn’t my code but rather my
certificates.

So the lesson is, remember to verify those certificates before using them.

Best regards,
Seb



-----Oprindelig meddelelse-----
Fra: pyo...@li...
[mailto:pyo...@li...] På vegne af Jean-Paul
Calderone
Sendt: 17. september 2008 23:02
Til: pyo...@li...
Emne: Re: [pyOpenSSL] How can I verify client that the client is signed by
me?

On Wed, 17 Sep 2008 22:51:40 +0200, Sebastian Greatful
<seb...@gm...> wrote:
><snip />
>>This isn't a complete example (and the line numbers would make it annoying
>>to actually run if it were ;).  A complete, minimal reproduction of the
>>problem would make it easier to diagnose.
>
>Sorry, I'm just copy pasting from vim.
>
>Server: http://paste.pocoo.org/show/85562/
>FileServer: http://paste.pocoo.org/show/85561/
>HttpServer: http://paste.pocoo.org/show/85563/
>Httplib: http://paste.pocoo.org/show/85564/
>
>
>Is that better? Just let me know how you want it.
>

The client code is important too (since it's the thing supplying the
certificate), as are the keys and certificates (since they determine
what the connection is actually verifying).  The HTTP parts probably
aren't important since the failure is happening at the SSL layer, so
the HTTP code probably never gets involved.  If you can provide a
file containing a server and a file containing a client such that when
run the client connects to the server and the server fails to decide
that the client's certificate is valid, that'd be best (basically, make
it possible for me to be really lazy, so that I am inclined to work on
this instead of on real work ;).

Jean-Paul

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great
prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
pyopenssl-list mailing list
pyo...@li...
https://lists.sourceforge.net/lists/listinfo/pyopenssl-list

Re: [pyOpenSSL] How can I verify client that the client is signed by me?

[Jean-Paul C. <ex...@di...>]

On Wed, 17 Sep 2008 22:51:40 +0200, Sebastian Greatful <seb...@gm...> wrote:
><snip />
>>This isn't a complete example (and the line numbers would make it annoying
>>to actually run if it were ;).  A complete, minimal reproduction of the
>>problem would make it easier to diagnose.
>
>Sorry, I'm just copy pasting from vim.
>
>Server: http://paste.pocoo.org/show/85562/
>FileServer: http://paste.pocoo.org/show/85561/
>HttpServer: http://paste.pocoo.org/show/85563/
>Httplib: http://paste.pocoo.org/show/85564/
>
>
>Is that better? Just let me know how you want it.
>

The client code is important too (since it's the thing supplying the
certificate), as are the keys and certificates (since they determine
what the connection is actually verifying).  The HTTP parts probably
aren't important since the failure is happening at the SSL layer, so
the HTTP code probably never gets involved.  If you can provide a
file containing a server and a file containing a client such that when
run the client connects to the server and the server fails to decide
that the client's certificate is valid, that'd be best (basically, make
it possible for me to be really lazy, so that I am inclined to work on
this instead of on real work ;).

Jean-Paul

Re: [pyOpenSSL] How can I verify client that the client is signed by me?

[Sebastian G. <seb...@gm...>]

<snip />
>This isn't a complete example (and the line numbers would make it annoying
>to actually run if it were ;).  A complete, minimal reproduction of the
>problem would make it easier to diagnose.

Sorry, I'm just copy pasting from vim.

Server: http://paste.pocoo.org/show/85562/
FileServer: http://paste.pocoo.org/show/85561/
HttpServer: http://paste.pocoo.org/show/85563/
Httplib: http://paste.pocoo.org/show/85564/


Is that better? Just let me know how you want it.


The actual project is a distributed filesystem with a http interface.
In order for the project to run you need a running pyro-ns (pyro name
server)

The SSL part is in the "Server"

I really appreciate the your help, thanks a lot

Best regards,
Seb

Re: [pyOpenSSL] How can I verify client that the client is signed by me?

[Jean-Paul C. <ex...@di...>]

On Wed, 17 Sep 2008 22:18:22 +0200, Sebastian Greatful <seb...@gm...> wrote:
> [snip]
>
>Any ideas on where I go wrong?

>
>50 class SSLTCPServer(TCPServer):
> 51         keyFile = "sslcert/server.key"
> 52         certFile = "sslcert/server.crt"
> 53         caFile = "sslcert/ca.crt"
> 54         def __init__(self, server_address, RequestHandlerClass):
> 55                 ctx = SSL.Context(SSL.SSLv23_METHOD)
> 56                 ctx.use_privatekey_file(self.keyFile)
> 57                 ctx.use_certificate_file(self.certFile)
> 58                 ctx.load_verify_locations(self.caFile)
> 59                 ctx.set_verify(SSL.VERIFY_PEER |
>SSL.VERIFY_FAIL_IF_NO_PEER_CERT | SSL.VERIFY_CLIENT_ONCE, self._verify)
> 60                 ctx.set_verify_depth(10)
> 61                 ctx.set_session_id('DFS')
> 62
> 63                 self.server_address = server_address
> 64                 self.RequestHandlerClass = RequestHandlerClass
> 65                 self.socket = socket.socket(self.address_family,
>self.socket_type)
> 66                 self.socket = SSL.Connection(ctx, self.socket)
> 67                 self.socket.bind(self.server_address)
> 68                 self.socket.listen(self.request_queue_size)
> 69
> 70         def _verify(self, conn, cert, errno, depth, retcode):
> 71                 return retcode
>

This isn't a complete example (and the line numbers would make it annoying
to actually run if it were ;).  A complete, minimal reproduction of the
problem would make it easier to diagnose.

Jean-Paul

Re: [pyOpenSSL] How can I verify client that the client is signed by me?

[Sebastian G. <seb...@gm...>]

>-----Oprindelig meddelelse-----
>Fra: pyo...@li...
[mailto:pyo...@li...] På >vegne af Jean-Paul
Calderone
>Sendt: 17. september 2008 21:54
>Til: pyo...@li...
>Emne: Re: [pyOpenSSL] How can I verify client that the client is signed by
me?

>On Wed, 17 Sep 2008 21:44:51 +0200, Sebastian Greatful
<seb...@gm...> wrote:
>>I now execute load_verify_locations on the Context object, instead... doh!
>>
>>However I'm still very unsure about how to handle the retcode... all hints
>>appreciated :)

>If it's false, return false from your verify callback.  If it's true,
either
>return true, or do whatever extra checks you want and return the result of
>them.

So basically I should just return it? Since I at the moment don’t want to
verify on other parameters...

I the code is as below and I have used the following guide
http://www.impetus.us/~rjmooney/projects/misc/clientcertauth.html to
generate the cert's. However the retcode remains false. Even though the
client's certificate really should be signed with the file referred to by
caFile.

Any ideas on where I go wrong?


50 class SSLTCPServer(TCPServer):
 51         keyFile = "sslcert/server.key"
 52         certFile = "sslcert/server.crt"
 53         caFile = "sslcert/ca.crt"
 54         def __init__(self, server_address, RequestHandlerClass):
 55                 ctx = SSL.Context(SSL.SSLv23_METHOD)
 56                 ctx.use_privatekey_file(self.keyFile)
 57                 ctx.use_certificate_file(self.certFile)
 58                 ctx.load_verify_locations(self.caFile)
 59                 ctx.set_verify(SSL.VERIFY_PEER |
SSL.VERIFY_FAIL_IF_NO_PEER_CERT | SSL.VERIFY_CLIENT_ONCE, self._verify)
 60                 ctx.set_verify_depth(10)
 61                 ctx.set_session_id('DFS')
 62
 63                 self.server_address = server_address
 64                 self.RequestHandlerClass = RequestHandlerClass
 65                 self.socket = socket.socket(self.address_family,
self.socket_type)
 66                 self.socket = SSL.Connection(ctx, self.socket)
 67                 self.socket.bind(self.server_address)
 68                 self.socket.listen(self.request_queue_size)
 69
 70         def _verify(self, conn, cert, errno, depth, retcode):
 71                 return retcode

Re: [pyOpenSSL] How can I verify client that the client is signed by me?

[Jean-Paul C. <ex...@di...>]

On Wed, 17 Sep 2008 21:44:51 +0200, Sebastian Greatful <seb...@gm...> wrote:
>I now execute load_verify_locations on the Context object, instead... doh!
>
>However I'm still very unsure about how to handle the retcode... all hints
>appreciated :)

If it's false, return false from your verify callback.  If it's true, either
return true, or do whatever extra checks you want and return the result of
them.

Jean-Paul

Re: [pyOpenSSL] How can I verify client that the client is signed by me?

[Sebastian G. <seb...@gm...>]

I now execute load_verify_locations on the Context object, instead... doh!

However I'm still very unsure about how to handle the retcode... all hints
appreciated :)

Best regards,
Seb

Re: [pyOpenSSL] How can I verify client that the client is signed by me?

[Sebastian G. <seb...@gm...>]

-----Oprindelig meddelelse-----
Fra: pyo...@li...
[mailto:pyo...@li...] På vegne af Jean-Paul
Calderone
Sendt: 17. september 2008 20:30
Til: pyo...@li...
Emne: Re: [pyOpenSSL] How can I verify client that the client is signed by
me?


<snip />

>If you want to make sure the client's certificate is signed by a particular
>key which your server has, then you should specify that key's corresponding
>certificate as a trusted CA certificate (with a method of the context
object,
>perhaps load_verify_locations, though there are a bunch of functions which
>do similar things, the correct one for you may depend on some other
factors).
>

That’s exactly what I'm trying to do. However I can't make the
load_verify_locations
Function work. Executing the code below I get (<class
exceptions.AttributeError at 0x2b891d0596b0>, <exceptions.AttributeError
instance at 0x2b891ed9d758>, <traceback object at 0x2b891ed9d830>)

71         def _verify(self, conn, cert, errno, depth, retcode):
 72                 try:
 73                         cert.load_verify_locations(self.caFile)
 74                 except:
 75                         print sys.exc_info()


>Then, make sure you respect OpenSSL's decision in the verify callback.
This
>is given by the `retcode` parameter.  If the client's certificate is not
>signed by a certificate you told the context object to consider a trusted
CA
>certificate, `retcode` will be false.  You can add whatever additional
>checks you want on top of that (ie, for the subject's name or what have
you)
>but if `retcode` is false, you should return false from the verify
function.

I'd very much like to do so :) But does that mean that I should set it to
something or 
check it or what?

Best regards,
Seb

Re: [pyOpenSSL] signing a cert request with DSA

[Jean-Paul C. <ex...@di...>]

On Thu, 11 Sep 2008 00:56:26 -0700, Dan Wendlandt <da...@gm...> wrote:
>Apologies if I missed the answer to this while searching list archives
>and google, but I have a very simple issue:
>
>If i run the examples/mk_simple_certs.py file from the tarball, but
>change the two instances of TYPE_RSA to TYPE_DSA, the code fails with
>the following error:
>
>$ python2.5 mk_simple_certs.py
>Traceback (most recent call last):
> File "mk_simple_certs.py", line 8, in <module>
>   careq = createCertRequest(cakey, CN='Certificate Authority')
> File "/home/danwent/Desktop/pyOpenSSL-0.7/examples/certgen.py", line
>51, in createCertRequest
>   req.sign(pkey, digest)
>OpenSSL.crypto.Error: [('digital envelope routines', 'EVP_SignFinal',
>'wrong public key type'), ('asn1 encoding routines', 'ASN1_item_sign',
>'EVP lib')]
>
>The above code worked fine for TYPE_RSA.
>
>Performing the equivalent operations via the command-line 'openssl'
>utility seems to work for DSA keys.
>
>I have PyOpenSSL version 0.7, installed from the standard debian
>package.  I am running debian testing.
>
>system info: Linux 2.6.25-2-686 #1 SMP Fri Jul 18 17:46:56 UTC 2008
>i686 GNU/Linux
>
>openssl: 7$ OpenSSL 0.9.8g 19 Oct 2007
>
>Any help would be appreciated.  Thanks,
>

Hi Dan,

No idea what's going on here.  It seems like it's probably a pyOpenSSL
bug, but I'm not sure where.  Do you feel like looking through the
implementation of the `openssl ca´ command (I assume that's the equivalent
command you're talking about, correct me if I'm wrong) to see if you can
see what it is doing differently from pyOpenSSL's PKey.sign method?

Jean-Paul

Re: [pyOpenSSL] How can I verify client that the client is signed by me?

[Jean-Paul C. <ex...@di...>]

On Wed, 17 Sep 2008 20:01:30 +0200, Sebastian Greatful <seb...@gm...> wrote:
>I'm building a ssl tcp server using the code below. However I'm unsure about
>how to actually verify the client's cert.
>
>50 class SSLTCPServer(TCPServer):
>
> 51         keyFile = "sslcert/server.key"
>
> 52         certFile = "sslcert/server.crt"
>
> 53         def __init__(self, server_address, RequestHandlerClass):
>
> 54                 ctx = SSL.Context(SSL.SSLv23_METHOD)
>
> 55                 ctx.use_privatekey_file(self.keyFile)
>
> 56                 ctx.use_certificate_file(self.certFile)
>
> 57                 ctx.set_verify(SSL.VERIFY_PEER |
>SSL.VERIFY_FAIL_IF_NO_PEER_CERT | SSL.VERIFY_CLIENT_ONCE, self._verify)
>
> 58                 ctx.set_verify_depth(10)
>
> 59                 ctx.set_session_id('DFS')
>
> 60
>
> 61                 self.server_address = server_address
>
> 62                 self.RequestHandlerClass = RequestHandlerClass
>
> 63                 self.socket = socket.socket(self.address_family,
>self.socket_type)
>
> 64                 self.socket = SSL.Connection(ctx, self.socket)
>
> 65                 self.socket.bind(self.server_address)
>
> 66                 self.socket.listen(self.request_queue_size)
>
> 67
>
> 68         def _verify(self, conn, cert, errno, depth, retcode):
>
> 69                 return not cert.has_expired() and
>cert.get_issuer().organizationName == 'DFS'
>
>Anyone got an idea about how to actually build the _verify method?
>

If you want to make sure the client's certificate is signed by a particular
key which your server has, then you should specify that key's corresponding
certificate as a trusted CA certificate (with a method of the context object,
perhaps load_verify_locations, though there are a bunch of functions which
do similar things, the correct one for you may depend on some other factors).

Then, make sure you respect OpenSSL's decision in the verify callback.  This
is given by the `retcode` parameter.  If the client's certificate is not
signed by a certificate you told the context object to consider a trusted CA
certificate, `retcode` will be false.  You can add whatever additional
checks you want on top of that (ie, for the subject's name or what have you)
but if `retcode` is false, you should return false from the verify function.

This includes things like expiration checking, so you don't need to do that.

Jean-Paul

[pyOpenSSL] How can I verify client that the client is signed by me?

[Sebastian G. <seb...@gm...>]

I'm building a ssl tcp server using the code below. However I'm unsure about
how to actually verify the client's cert.

 

50 class SSLTCPServer(TCPServer):

 51         keyFile = "sslcert/server.key"

 52         certFile = "sslcert/server.crt"

 53         def __init__(self, server_address, RequestHandlerClass):

 54                 ctx = SSL.Context(SSL.SSLv23_METHOD)

 55                 ctx.use_privatekey_file(self.keyFile)

 56                 ctx.use_certificate_file(self.certFile)

 57                 ctx.set_verify(SSL.VERIFY_PEER |
SSL.VERIFY_FAIL_IF_NO_PEER_CERT | SSL.VERIFY_CLIENT_ONCE, self._verify)

 58                 ctx.set_verify_depth(10)

 59                 ctx.set_session_id('DFS')

 60

 61                 self.server_address = server_address

 62                 self.RequestHandlerClass = RequestHandlerClass

 63                 self.socket = socket.socket(self.address_family,
self.socket_type)

 64                 self.socket = SSL.Connection(ctx, self.socket)

 65                 self.socket.bind(self.server_address)

 66                 self.socket.listen(self.request_queue_size)

 67

 68         def _verify(self, conn, cert, errno, depth, retcode):

 69                 return not cert.has_expired() and
cert.get_issuer().organizationName == 'DFS'

 

 

Anyone got an idea about how to actually build the _verify method?

 

Thanks in advance,

Seb

[pyOpenSSL] signing a cert request with DSA

[Dan W. <da...@gm...>]

Apologies if I missed the answer to this while searching list archives
and google, but I have a very simple issue:

If i run the examples/mk_simple_certs.py file from the tarball, but
change the two instances of TYPE_RSA to TYPE_DSA, the code fails with
the following error:

$ python2.5 mk_simple_certs.py
Traceback (most recent call last):
 File "mk_simple_certs.py", line 8, in <module>
   careq = createCertRequest(cakey, CN='Certificate Authority')
 File "/home/danwent/Desktop/pyOpenSSL-0.7/examples/certgen.py", line
51, in createCertRequest
   req.sign(pkey, digest)
OpenSSL.crypto.Error: [('digital envelope routines', 'EVP_SignFinal',
'wrong public key type'), ('asn1 encoding routines', 'ASN1_item_sign',
'EVP lib')]

The above code worked fine for TYPE_RSA.

Performing the equivalent operations via the command-line 'openssl'
utility seems to work for DSA keys.

I have PyOpenSSL version 0.7, installed from the standard debian
package.  I am running debian testing.

system info: Linux 2.6.25-2-686 #1 SMP Fri Jul 18 17:46:56 UTC 2008
i686 GNU/Linux

openssl: 7$ OpenSSL 0.9.8g 19 Oct 2007

Any help would be appreciated.  Thanks,

dan

-- 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Dan Wendlandt
650-906-2650
http://www.cs.cmu.edu/~dwendlan/
4250 El Camino Real, Apt A306
Palo Alto, CA 94306
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Re: [pyOpenSSL] PKCS12 bzr branch

[Jean-Paul C. <ex...@di...>]

On Wed, 10 Sep 2008 17:43:11 +0200 (CEST), arn...@fr... wrote:
>My idea was to split pkcs12 and crl into separate branches because pkcs12-crl name was already used and I did not have upload rights on it.
>pkcs12-crl is not up to date regarding documentation, tests, and the "PY_DECREF bug".
>
>If you think that splitting PKCS12 and CRL is useless I can update your pkcs12-crl branch. Otherwise remove pkcs12-crl.

Splitting it up sounds good.  I'll delete pkcs12-crl.

Jean-Paul