Merge lp:~jorton/pyopenssl/trust into lp:~exarkun/pyopenssl/trunk

[Joe Orton]

Add support for loading and dumping trusted certificates.

Expose trust attributes in the API.

Unmerged revisions

131. By Joe Orton on 2010-04-20

Add support for simple trusted certificate handling, and manipulation
of a certificates trust bits:

* src/crypto/crypto.c (crypto_load_trusted_certificate,
  crypto_dump_trusted_certificate): New methods.
  (initcrypto): Add TRUST_* string constants.

* src/crypto/x509.c (crypto_X509_set_trusted_uses,
  crypto_X509_get_trusted_uses, crypto_X509_get_rejected_uses,
  crypto_X509_set_rejected_uses): New methods.
  (crypto_set_trust_or_reject, crypto_X509_stack_to_list):
  New utility function.

* test/test_crypto.py (FunctionTests.test_trusted_certificates):
  New test case.

130. By Joe Orton on 2010-04-20

* .bzrignore: Ignore test output.

129. By Joe Orton on 2010-04-20

* .bzrignore: New file; ignore build directory.

=== added file '.bzrignore'
--- .bzrignore	1970-01-01 00:00:00 +0000
+++ .bzrignore	2010-06-10 08:46:24 +0000
@@ -0,0 +1,2 @@
+build
+_trial_temp

=== modified file 'src/crypto/crypto.c'
--- src/crypto/crypto.c	2010-05-24 22:04:59 +0000
+++ src/crypto/crypto.c	2010-06-10 08:46:24 +0000
@@ -328,6 +328,113 @@
     return buffer;
 }
 
+static char crypto_load_trusted_certificate_doc[] = "\n\
+Load a trusted certificate from a buffer\n\
+\n\
+@param type: The file type (one of FILETYPE_PEM, FILETYPE_ASN1)\n\
+             buffer - The buffer the certificate is stored in\n\
+@return: The X509 object\n\
+";
+
+static PyObject *
+crypto_load_trusted_certificate(PyObject *spam, PyObject *args)
+{
+    crypto_X509Obj *crypto_X509_New(X509 *, int);
+    int type, len;
+    char *buffer;
+    BIO *bio;
+    X509 *cert;
+
+    if (!PyArg_ParseTuple(args, "is#:load_trusted_certificate", &type, &buffer, &len))
+        return NULL;
+
+    bio = BIO_new_mem_buf(buffer, len);
+    switch (type)
+    {
+        case X509_FILETYPE_PEM:
+            cert = PEM_read_bio_X509_AUX(bio, NULL, NULL, NULL);
+            break;
+
+#if 0 /* not implemented yet */
+        case X509_FILETYPE_ASN1:
+            cert = d2i_X509_AUX_bio(bio, NULL);
+            break;
+#endif
+
+        default:
+            PyErr_SetString(PyExc_ValueError, "type argument must be FILETYPE_PEM");
+            BIO_free(bio);
+            return NULL;
+    }
+    BIO_free(bio);
+
+    if (cert == NULL)
+    {
+        exception_from_error_queue(crypto_Error);
+        return NULL;
+    }
+
+    return (PyObject *)crypto_X509_New(cert, 1);
+}
+
+static char crypto_dump_trusted_certificate_doc[] = "\n\
+Dump a trusted certificate to a buffer\n\
+\n\
+@param type: The file type (one of FILETYPE_PEM, FILETYPE_ASN1)\n\
+@param cert: The certificate to dump\n\
+@return: The buffer with the dumped certificate in\n\
+";
+
+static PyObject *
+crypto_dump_trusted_certificate(PyObject *spam, PyObject *args)
+{
+    int type, ret, buf_len;
+    char *temp;
+    PyObject *buffer;
+    BIO *bio;
+    crypto_X509Obj *cert;
+
+    if (!PyArg_ParseTuple(args, "iO!:dump_trusted_certificate", &type,
+			  &crypto_X509_Type, &cert))
+        return NULL;
+
+    bio = BIO_new(BIO_s_mem());
+    switch (type)
+    {
+        case X509_FILETYPE_PEM:
+            ret = PEM_write_bio_X509_AUX(bio, cert->x509);
+            break;
+
+#if 0 /* not implemented */
+        case X509_FILETYPE_ASN1:
+            ret = i2d_X509_bio(bio, cert->x509);
+            break;
+
+        case X509_FILETYPE_TEXT:
+            ret = X509_print_ex(bio, cert->x509, 0, 0);
+            break;
+#endif
+
+        default:
+            PyErr_SetString(PyExc_ValueError, "type argument must be FILETYPE_PEM");
+            BIO_free(bio);
+            return NULL;
+    }
+
+    if (ret == 0)
+    {
+        BIO_free(bio);
+        exception_from_error_queue(crypto_Error);
+        return NULL;
+    }
+
+    buf_len = BIO_get_mem_data(bio, &temp);
+    buffer = PyString_FromStringAndSize(temp, buf_len);
+    BIO_free(bio);
+
+    return buffer;
+}
+
 static char crypto_load_certificate_request_doc[] = "\n\
 Load a certificate request from a buffer\n\
 \n\
@@ -598,6 +705,9 @@
     { "dump_privatekey",  (PyCFunction)crypto_dump_privatekey,  METH_VARARGS, crypto_dump_privatekey_doc },
     { "load_certificate", (PyCFunction)crypto_load_certificate, METH_VARARGS, crypto_load_certificate_doc },
     { "dump_certificate", (PyCFunction)crypto_dump_certificate, METH_VARARGS, crypto_dump_certificate_doc },
+
+    { "load_trusted_certificate", (PyCFunction)crypto_load_trusted_certificate, METH_VARARGS, crypto_load_trusted_certificate_doc },
+    { "dump_trusted_certificate", (PyCFunction)crypto_dump_trusted_certificate, METH_VARARGS, crypto_dump_trusted_certificate_doc },
     { "load_certificate_request", (PyCFunction)crypto_load_certificate_request, METH_VARARGS, crypto_load_certificate_request_doc },
     { "dump_certificate_request", (PyCFunction)crypto_dump_certificate_request, METH_VARARGS, crypto_dump_certificate_request_doc },
     { "load_crl",         (PyCFunction)crypto_load_crl,         METH_VARARGS, crypto_load_crl_doc },
@@ -713,6 +823,13 @@
     if (PyModule_AddObject(module, "Error", crypto_Error) != 0)
         goto error;
 
+    PyModule_AddStringConstant(module, "TRUST_SSL_SERVER", SN_server_auth);
+    PyModule_AddStringConstant(module, "TRUST_SSL_CLIENT", SN_client_auth);
+    PyModule_AddStringConstant(module, "TRUST_OBJECT_SIGN", SN_code_sign);
+    PyModule_AddStringConstant(module, "TRUST_EMAIL", SN_email_protect);
+    PyModule_AddStringConstant(module, "TRUST_TSA", SN_time_stamp);
+    PyModule_AddStringConstant(module, "TRUST_OCSP_SIGN", SN_OCSP_sign);
+
     PyModule_AddIntConstant(module, "FILETYPE_PEM",  X509_FILETYPE_PEM);
     PyModule_AddIntConstant(module, "FILETYPE_ASN1", X509_FILETYPE_ASN1);
     PyModule_AddIntConstant(module, "FILETYPE_TEXT", X509_FILETYPE_TEXT);

=== modified file 'src/crypto/x509.c'
--- src/crypto/x509.c	2010-01-25 22:55:30 +0000
+++ src/crypto/x509.c	2010-06-10 08:46:24 +0000
@@ -3,6 +3,7 @@
  *
  * Copyright (C) AB Strakt 2001, All rights reserved
  * Copyright (C) Jean-Paul Calderone 2008, All rights reserved
+ * Copyright (C) Red Hat, Inc. 2010.
  *
  * Certificate (X.509) handling code, mostly thin wrappers around OpenSSL.
  * See the file RATIONALE for a short explanation of why this module was written.
@@ -688,6 +689,170 @@
     return Py_None;
 }
 
+/* Return sorted list object with short names of objects in stack. */
+static PyObject *
+crypto_X509_stack_to_list(STACK_OF(ASN1_OBJECT *) stack)
+{
+    PyObject *list;
+    int i, n;
+
+    n = sk_ASN1_OBJECT_num(stack);
+    list = PyList_New(n);
+    
+    for (i = 0; i < n; i++) 
+    {
+        ASN1_OBJECT *obj = sk_ASN1_OBJECT_value(stack, i);
+        int nid = OBJ_obj2nid(obj);
+        const char *sn = OBJ_nid2sn(nid);
+        
+        if (sn) 
+        {
+            PyList_SetItem(list, i, PyString_FromString(sn));
+        }
+        else 
+        {
+            PyErr_SetString(PyExc_RuntimeError, "Unknown name for nid");
+            Py_DECREF(list);
+            return NULL;
+        }
+    }
+
+    if (PyList_Sort(list)) 
+    {
+        PyErr_SetString(PyExc_RuntimeError, "Failed to sort list");
+        Py_DECREF(list);
+        return NULL;
+    }
+
+    return list;
+}
+
+static char crypto_X509_get_trusted_uses_doc[] = "\n\
+Return a list of the trusted uses for the certificate.\n\
+\n\
+@return: A list of strings, or None if the cert contains no trust information.\n\
+";
+
+static PyObject *
+crypto_X509_get_trusted_uses(crypto_X509Obj *self, PyObject *args)
+{
+    if (!PyArg_ParseTuple(args, ":get_trusted_uses"))
+        return NULL;
+
+    if (self->x509->aux && self->x509->aux->trust) 
+    {
+        return crypto_X509_stack_to_list(self->x509->aux->trust);
+    }
+    else 
+    {
+        Py_INCREF(Py_None);
+        return Py_None;
+    }
+}
+
+static char crypto_X509_get_rejected_uses_doc[] = "\n\
+Return a list of rejected uses for the certificate.\n\
+\n\
+@return: A list of strings, or None if the cert contains no trust information.\n\
+";
+static PyObject *
+crypto_X509_get_rejected_uses(crypto_X509Obj *self, PyObject *args)
+{
+    if (!PyArg_ParseTuple(args, ":get_rejected_uses"))
+        return NULL;
+
+    if (self->x509->aux && self->x509->aux->reject) 
+    {
+        return crypto_X509_stack_to_list(self->x509->aux->reject);
+    }
+    else 
+    {
+        Py_INCREF(Py_None);
+        return Py_None;
+    }
+}
+
+static PyObject *
+crypto_set_trust_or_reject(X509 *x509, PyObject *list, int trust)
+{
+    Py_ssize_t i, n;
+    int *nids;
+
+    n = PyList_Size(list);
+    nids = malloc(n * sizeof *nids);
+
+    for (i = 0; i < n; i++) 
+    {
+        PyObject *o = PyList_GET_ITEM(list, i);
+
+        if (!PyString_Check(o)) 
+        {
+            free(nids);
+            PyErr_SetString(PyExc_TypeError, "List must be of strings");
+            return NULL;
+        }
+
+        nids[i] = OBJ_sn2nid(PyString_AS_STRING(o));
+        if (nids[i] == NID_undef) 
+        {
+            free(nids);
+            PyErr_SetString(PyExc_ValueError, "Trust type not known");
+            return NULL;
+        }
+    }
+
+    X509_trust_clear(x509);
+
+    for (i = 0; i < n; i++) 
+    {
+        ASN1_OBJECT *obj = OBJ_nid2obj(nids[i]);
+        
+        if (trust)
+            X509_add1_trust_object(x509, obj);
+        else
+            X509_add1_reject_object(x509, obj);
+    }
+
+    free(nids);
+
+    Py_INCREF(Py_None);
+    return Py_None;
+}
+                           
+static char crypto_X509_set_trusted_uses_doc[] = "\n\
+Set the list of trusted uses for the certificate.\n\
+\n\
+@return: None\
+";
+static PyObject *
+crypto_X509_set_trusted_uses(crypto_X509Obj *self, PyObject *args)
+{
+    PyObject *list;
+
+    if (!PyArg_ParseTuple(args, "O!:set_trusted_uses", 
+                          &PyList_Type, &list))
+        return NULL;
+
+    return crypto_set_trust_or_reject(self->x509, list, 1);
+}
+
+static char crypto_X509_set_rejected_uses_doc[] = "\n\
+Set the list of rejected uses for the certificate.\n\
+\n\
+@return: None\
+";
+static PyObject *
+crypto_X509_set_rejected_uses(crypto_X509Obj *self, PyObject *args)
+{
+    PyObject *list;
+
+    if (!PyArg_ParseTuple(args, "O!:set_rejected_uses", 
+                          &PyList_Type, &list))
+        return NULL;
+
+    return crypto_set_trust_or_reject(self->x509, list, 0);
+}
+
 /*
  * ADD_METHOD(name) expands to a correct PyMethodDef declaration
  *   {  'name', (PyCFunction)crypto_X509_name, METH_VARARGS }
@@ -718,6 +883,10 @@
     ADD_METHOD(subject_name_hash),
     ADD_METHOD(digest),
     ADD_METHOD(add_extensions),
+    ADD_METHOD(get_trusted_uses),
+    ADD_METHOD(get_rejected_uses),
+    ADD_METHOD(set_trusted_uses),
+    ADD_METHOD(set_rejected_uses),
     { NULL, NULL }
 };
 #undef ADD_METHOD

=== modified file 'test/test_crypto.py'
--- test/test_crypto.py	2010-05-25 19:08:32 +0000
+++ test/test_crypto.py	2010-06-10 08:46:24 +0000
@@ -17,6 +17,9 @@
 from OpenSSL.crypto import load_certificate, load_privatekey
 from OpenSSL.crypto import FILETYPE_PEM, FILETYPE_ASN1, FILETYPE_TEXT
 from OpenSSL.crypto import dump_certificate, load_certificate_request
+from OpenSSL.crypto import load_trusted_certificate, dump_trusted_certificate
+from OpenSSL.crypto import TRUST_SSL_CLIENT, TRUST_SSL_SERVER
+from OpenSSL.crypto import TRUST_EMAIL, TRUST_OBJECT_SIGN
 from OpenSSL.crypto import dump_certificate_request, dump_privatekey
 from OpenSSL.crypto import PKCS7Type, load_pkcs7_data
 from OpenSSL.crypto import PKCS12, PKCS12Type, load_pkcs12
@@ -78,6 +81,23 @@
 -----END CERTIFICATE-----
 """
 
+server_trusted_cert_pem = """-----BEGIN TRUSTED CERTIFICATE-----
+MIICKDCCAZGgAwIBAgIJAJn/HpR21r/8MA0GCSqGSIb3DQEBBQUAMFgxCzAJBgNV
+BAYTAlVTMQswCQYDVQQIEwJJTDEQMA4GA1UEBxMHQ2hpY2FnbzEQMA4GA1UEChMH
+VGVzdGluZzEYMBYGA1UEAxMPVGVzdGluZyBSb290IENBMCIYDzIwMDkwMzI1MTIz
+NzUzWhgPMjAxNzA2MTExMjM3NTNaMBgxFjAUBgNVBAMTDWxvdmVseSBzZXJ2ZXIw
+gZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAL6m+G653V0tpBC/OKl22VxOi2Cv
+lK4TYu9LHSDP9uDVTe7V5D5Tl6qzFoRRx5pfmnkqT5B+W9byp2NU3FC5hLm5zSAr
+b45meUhjEJ/ifkZgbNUjHdBIGP9MAQUHZa5WKdkGIJvGAvs8UzUqlr4TBWQIB24+
+lJ+Ukk/CRgasrYwdAgMBAAGjNjA0MB0GA1UdDgQWBBS4kC7Ij0W1TZXZqXQFAM2e
+gKEG2DATBgNVHSUEDDAKBggrBgEFBQcDATANBgkqhkiG9w0BAQUFAAOBgQBh30Li
+dJ+NlxIOx5343WqIBka3UbsOb2kxWrbkVCrvRapCMLCASO4FqiKWM+L0VDBprqIp
+2mgpFQ6FHpoIENGvJhdEKpptQ5i7KaGhnDNTfdy3x1+h852G99f1iyj0RmbuFcM8
+uzujnS8YXWvM7DM1Ilozk4MzPug8jzFp5uhKCTAiMBQGCCsGAQUFBwMCBggrBgEF
+BQcDAaAKBggrBgEFBQcDAw==
+-----END TRUSTED CERTIFICATE-----
+"""
+
 server_key_pem = """-----BEGIN RSA PRIVATE KEY-----
 MIICWwIBAAKBgQC+pvhuud1dLaQQvzipdtlcTotgr5SuE2LvSx0gz/bg1U3u1eQ+
 U5eqsxaEUceaX5p5Kk+QflvW8qdjVNxQuYS5uc0gK2+OZnlIYxCf4n5GYGzVIx3Q
@@ -1446,6 +1466,36 @@
         good_text = _runopenssl(dumped_pem, "x509", "-noout", "-text")
         self.assertEqual(dumped_text, good_text)
 
+    def test_trusted_certificates(self):
+        """
+        L{load_trusted_certificate} test.
+        """
+        pemData = server_trusted_cert_pem
+        cert = load_trusted_certificate(FILETYPE_PEM, pemData)
+        self.assertTrue(isinstance(cert, X509Type))
+        dumped_pem = dump_trusted_certificate(FILETYPE_PEM, cert)
+        good_pem = _runopenssl(dumped_pem, "x509", "-outform", "PEM", "-trustout")
+        self.assertEqual(dumped_pem, good_pem)
+        self.assertEqual(dumped_pem, pemData)
+        # Test equivalence of trusted cert with normal cert
+        plaincert = load_certificate(FILETYPE_PEM, server_cert_pem)
+        self.assertEqual(plaincert.get_subject(), cert.get_subject())
+        trusted_uses = [TRUST_SSL_CLIENT, TRUST_SSL_SERVER]
+        trusted_uses.sort()
+        rejected_uses = [TRUST_OBJECT_SIGN]
+        self.assertEqual(cert.get_trusted_uses(), trusted_uses)
+        self.assertEqual(cert.get_rejected_uses(), rejected_uses)
+        self.assertEqual(plaincert.get_trusted_uses(), None)
+        self.assertEqual(plaincert.get_rejected_uses(), None)
+
+        trusted_uses = [TRUST_SSL_CLIENT]
+        cert.set_trusted_uses(trusted_uses)
+        self.assertEqual(cert.get_trusted_uses(), trusted_uses)
+
+        dump_pem2 = dump_trusted_certificate(FILETYPE_PEM, cert)
+        cert2 = load_trusted_certificate(FILETYPE_PEM, dump_pem2)
+
+        self.assertEqual(cert.get_trusted_uses(), trusted_uses)
 
     def test_dump_privatekey(self):
         """