pyopenssl-list

[pyOpenSSL] Missing API for client authentication renegotiation

[Emmanuel R. <era...@en...>]

Hello,

I'm using PyOpenSSL to develop a free software implementation of Liberty 
Alliance single sign-on protocol.
	http://lasso.entrouvert.org/souk

It works very well, but to improve client authentication, I need to 
renegotiate client verify mode after the SSL connection is established.

So, I would like to transpose the following C code into Python:
  	SSL_set_verify(ssl,SSL_VERIFY_PEER |
		SSL_VERIFY_FAIL_IF_NO_PEER_CERT,0);

	/* Stop the client from just resuming the
	   un-authenticated session */
	SSL_set_session_id_context(ssl,
		(void *)&s_server_auth_session_id_context,
         	sizeof(s_server_auth_session_id_context));

	SSL_renegotiate(ssl);
	SSL_do_handshake(ssl);
	ssl->state=SSL_ST_ACCEPT;
	SSL_do_handshake(ssl);

[This code fragment is taken from wserver2.c sample code by Eric 
Rescoria <http://www.rtfm.com/openssl-examples/>]

But I didn't find in PyOpenSSL a way to:
	- call SSL_set_verify
	- change ssl->state without using SSL_set_accept_state

Is this a missing feature of PyOpenSSL? Is there another way to 
implement client authentication renegotiation?

Regards,

Emmanuel Raviart

-- 
Lasso (Liberty Alliance Single Sign-On) -- http://lasso.entrouvert.org
Entr'ouvert -- www.entrouvert.com

[pyOpenSSL] Re: [PATCH] Missing API for client authentication renegotiation

[Frederic P. <fp...@de...>]

Emmanuel Raviart wrote:

> So, I would like to transpose the following C code into Python:
>  	SSL_set_verify(ssl,SSL_VERIFY_PEER |
> 		SSL_VERIFY_FAIL_IF_NO_PEER_CERT,0);
> 
> 	/* Stop the client from just resuming the
> 	   un-authenticated session */
> 	SSL_set_session_id_context(ssl,
> 		(void *)&s_server_auth_session_id_context,
>         	sizeof(s_server_auth_session_id_context));
> 
> 	SSL_renegotiate(ssl);
> 	SSL_do_handshake(ssl);
> 	ssl->state=SSL_ST_ACCEPT;
> 	SSL_do_handshake(ssl);

I wrote a patch for this; it adds bindings for SSL_set_verify,
SSL_set_verify_depth, SSL_get_verify_mode, SSL_get_verify_depth
and SSL_set_session_id_context.  It also adds to new methods,
set_state and get_state to SSL objects and the SSL state constants
(SSL_ST_*).

It has *not* been extensively tested and I'm not sure at all wrt
the global_verify_callback function I copied/pasted from context.c

What are the odds for this to be included in pyOpenSSL ?


Regards,

        Frederic