Merge lp:~rick-fdd/pyopenssl/pkcs12_mod_and_export2 into lp:~exarkun/pyopenssl/trunk
- pkcs12_mod_and_export2
- Merge into trunk
| Status: | Merged | ||||
|---|---|---|---|---|---|
| Merged at revision: | not available | ||||
| Proposed branch: | lp:~rick-fdd/pyopenssl/pkcs12_mod_and_export2 | ||||
| Merge into: | lp:~exarkun/pyopenssl/trunk | ||||
| Diff against target: | None lines | ||||
| To merge this branch: | bzr merge lp:~rick-fdd/pyopenssl/pkcs12_mod_and_export2 | ||||
| Related bugs: |
|
| Reviewer | Review Type | Date Requested | Status |
|---|---|---|---|
| Jean-Paul Calderone | Approve | ||
|
Review via email:
|
|||
Commit message
Description of the change
| rick_dean (rick-fdd) wrote : | # |
| Jean-Paul Calderone (exarkun) wrote : | # |
I should have mentioned earlier that there is someone who recently showed up on the mailing list (over on sourceforge) who is also a bit interested in this area (although he says he's more keen on CRLs than PKCS12). He's pushed a branch, <lp:~phil-mayers/pyopenssl/crl+morepkcs12>, which has some overlap with this one. I mostly prefer the PKCS12 code in this branch. I particularly like the documentation additions and many of the test suite additions. Here are some areas I think could be improved, though:
1. crypto_
2. There's a left over C99-style comment near the definition of crypto_
3. crypto_
4. crypto_
5. Hm. The way PKCS12 handles its CA certificates list has a hole. In trunk, crypto_PKCS12_New always creates cacerts, and makes it a tuple. This is good, since get_ca_certificates will return it directly, and if it were a list, callers could modify it in ways which would probably result in a crash later. With this branch, they can pass a list to set_ca_
6. All the code handling the key, cert, and cacerts fields of crypto_PKCS12Obj structures would probably be simpler if only one of NULL or Py_None were possible values. I think that may really already be the case anyway. crypto_PKCS12_New starts of setting key and cert to NULL, but then immediately either sets them to a PyObject* or goes to the error case. What happens when the NULL checks for key, cert, and cacerts are removed, and just the Py_None checks are left in place (where necessary)?
7. Regarding int vs Py_ssize_t, we should probably put a version-protected typedef into util.h or someplace, so we can spell this in a way that works with all supported versions and actually does the right thing on newer Pythons.
8. Still in crypto_
9. crypto_
10. Test method docstrings. I would prefer docstrings which describe some desired behavior which the test is verifying pyOpenSSL actually provides.
11. test_export_
I kinda skimmed the export code, I'm too sleepy at this point to do it justice. I'll have another look soon. Thanks.
| rick_dean (rick-fdd) wrote : | # |
On Sat, Jul 18, 2009 at 03:04:46AM -0000, Jean-Paul Calderone wrote:
> Review: Needs Fixing
> I should have mentioned earlier that there is someone who recently showed up on the mailing list (over on sourceforge) who is also a bit interested in this area (although he says he's more keen on CRLs than PKCS12). He's pushed a branch, <lp:~phil-mayers/pyopenssl/crl+morepkcs12>, which has some overlap with this one. I mostly prefer the PKCS12 code in this branch. I particularly like the documentation additions and many of the test suite additions. Here are some areas I think could be improved, though:
Thanks. I just subscribed.
It's great to be able to compare code. His crypto_
leaks objects when trying to replace an existing one. Likewise
for crypto_
CA certificates isn't implemented. Except for export, our API
is identical.
>
> 1. crypto_
Agreed. fixed.
FWIW, returning the object is a very ruby thing to do, so
you can chain together multple method calls on one line.
> 2. There's a left over C99-style comment near the definition of crypto_
Ooops. Fixed.
> 3. crypto_
Agreed. fixed.
> 4. crypto_
Agreed. fixed.
> 5. Hm. The way PKCS12 handles its CA certificates list has a hole. In trunk, crypto_PKCS12_New always creates cacerts, and makes it a tuple. This is good, since get_ca_certificates will return it directly, and if it were a list, callers could modify it in ways which would probably result in a crash later. With this branch, they can pass a list to set_ca_
> 6. All the code handling the key, cert, and cacerts fields of crypto_PKCS12Obj structures would probably be simpler if only one of NULL or Py_None were possible values. I think that may really already be the case anyway. crypto_PKCS12_New starts of setting key and cert to NULL, but then immediately either sets them to a PyObject* or goes to the error case. What happens when the NULL checks for key, cert, and cacerts are removed, and just the Py_None checks are left in place (where necessary)?
> 7. Regarding int vs Py_ssize_t, we should probably put a version-protected typedef into util.h or someplace, so we can spell this in a way that works with all supported versions and actually does the right thing on newer Pythons.
Agreed, but I'm too lazy to test it right now.
#if !defined(
typedef int Py_ssize_t
#endif
> 8. Still in crypto_
- 124. By rick_dean
-
broke the monster PKCS12 test into little ones, and other PKCS12 test additions.
- 125. By rick_dean
-
Move all the PEM to test_crypto.py, so both it and test_ssl.py can use them without circular includes.
- 126. By rick_dean
-
The PyObjets of struct crypto_PKCS12Obj are never NULL so stop checking.
| rick_dean (rick-fdd) wrote : | # |
On Sat, Jul 18, 2009 at 03:04:46AM -0000, Jean-Paul Calderone wrote:
> 5. Hm. The way PKCS12 handles its CA certificates list has a hole. In trunk, crypto_PKCS12_New always creates cacerts, and makes it a tuple. This is good, since get_ca_certificates will return it directly, and if it were a list, callers could modify it in ways which would probably result in a crash later. With this branch, they can pass a list to set_ca_
Yeah, good point. crypto_
that could fix this, but I like your tuple conversion idea better.
I'll give it a try.
> 6. All the code handling the key, cert, and cacerts fields of crypto_PKCS12Obj structures would probably be simpler if only one of NULL or Py_None were possible values. I think that may really already be the case anyway. crypto_PKCS12_New starts of setting key and cert to NULL, but then immediately either sets them to a PyObject* or goes to the error case. What happens when the NULL checks for key, cert, and cacerts are removed, and just the Py_None checks are left in place (where necessary)?
Agreed. The PyObjects of crypto_PKCS12Obj are never NULL.
Fixed. The checks are gone.
Can we ever traverse an object after a clear? I left in that NULL check.
In theory could the PyDECREF() of self->key in crypto_
call a desctructor which could access the PKCS12 object and cause
trouble with the now NULL self->cert? I suppose we should try
for a test case. Agressively eliminating NULL checks makes
me nervious, and if you let me, I'd leave them in.
> 8. Still in crypto_
Can PySequence_Length() fail after PySequence_Check() retuned
success? There is little point to PySequence_Check() then, as we
should just call PySequence_Length() and compare to zero. Likewise,
for PySequence_
I'd love to see a failing test case for this, if you can make one.
> 11. test_export_
Fixed. The monster has been slain. Where is my knighthood? :-)
>
> --
> https:/
> You are the owner of lp:~rick-fdd/pyopenssl/pkcs12_mod_and_export2.
We should create set and get functions for friendly_name
instead of a parameter of export, so our API can better support
reading them from loaded certificates.
--
Rick
| rick_dean (rick-fdd) wrote : | # |
All of JP's comments have been implemented except
for the Py_ssize_t which I don't have the energy
to test. This branch is ready for merge.
The commit list shows the more recent commits
but the diff does not.
| Jean-Paul Calderone (exarkun) wrote : | # |
I wrote a nicer review, but firefox crashed and ate it. This one's a bit terser, sorry.
1. crypto_
2. The return type of crypto_
3. crypto_
4. It's hard to tell for sure, but I *think* PKCS12_create doesn't take over the cacerts stack passed to it. So I think crypto_
5. In crypto_PKCS12_New, cacerts is leaked in all the error cases.
- 131. By rick_dean
-
Convert cacerts to tuple() before type checking so iterators can't play games with us. Jean-Paul's find.
- 132. By rick_dean
-
Fix return type of crypto_
PKCS12_ set_friendlynam e(). Jean-Paul's find. - 133. By rick_dean
-
Use PyString_
CheckExact( ) in crypto_ PKCS12_ set_friendlynam e(). Jean-Paul's find. - 134. By rick_dean
-
Stop leaking a STACK_OF(X509) on error cases of crypto_
PKCS12_ New(). Add a test case of that. Jean-Paul's find. - 135. By rick_dean
-
Stop leaking a STACK_OF(X509) in crypto_
PKCS12_ export. Jean-Paul's find. - 136. By rick_dean
-
More fixes of STACK_OF(X509) in crypto_
PKCS12_ New(). - 137. By rick_dean
-
Only allocate a STACK_OF(X509) in crypto_
PKCS12_ export( ) when needed.
| rick_dean (rick-fdd) wrote : | # |
Excellent points! Thanks for the lesson. I pushed all five
fixes to lp:~rick-fdd/pyopenssl/pkcs12_mod_and_export2
--
Rick
On Fri, Jul 24, 2009 at 04:16:38AM -0000, Jean-Paul Calderone wrote:
> I wrote a nicer review, but firefox crashed and ate it. This one's a bit terser, sorry.
>
> 1. crypto_
> 2. The return type of crypto_
> 3. crypto_
> 4. It's hard to tell for sure, but I *think* PKCS12_create doesn't take over the cacerts stack passed to it. So I think crypto_
> 5. In crypto_PKCS12_New, cacerts is leaked in all the error cases.
>
> --
> https:/
> You are the owner of lp:~rick-fdd/pyopenssl/pkcs12_mod_and_export2.
| Jean-Paul Calderone (exarkun) wrote : | # |
>
> Excellent points! Thanks for the lesson. I pushed all five
> fixes to lp:~rick-fdd/pyopenssl/pkcs12_mod_and_export2
>
Awesome, thanks for all your work on this. :) I made a bunch of cosmetic changes (I should put
together a style guide for pyOpenSSL, but I'm still not sure what it would say), but notices a
couple more actual potential issues, which I also tried to tackle. My changes are in a branch
based on yours, <lp:~exarkun/pyopenssl/pkcs12_mod_and_export2>. The revisions which actually
contain interesting changes are:
http://
http://
http://
I think I'm happy with the code now, so if you think these changes are sensible, I think I'll go ahead and merge them into trunk.
Jean-Paul
| rick_dean (rick-fdd) wrote : | # |
I didn't know whose curly bracket style that was, yours
or openssl's. As long as we don't adopt the thousand
line function style of openssl, I'll be happy. :-)
#149 looks good. If Py_BuildValue returned NULL, it
was like the alias didn't exist. I contemplated an
error message, but chose not to. With the new code
maybe we should.
On Sun, Jul 26, 2009 at 01:57:57AM -0000, Jean-Paul Calderone wrote:
> >
> > Excellent points! Thanks for the lesson. I pushed all five
> > fixes to lp:~rick-fdd/pyopenssl/pkcs12_mod_and_export2
> >
>
> Awesome, thanks for all your work on this. :) I made a bunch of cosmetic changes (I should put
> together a style guide for pyOpenSSL, but I'm still not sure what it would say), but notices a
> couple more actual potential issues, which I also tried to tackle. My changes are in a branch
> based on yours, <lp:~exarkun/pyopenssl/pkcs12_mod_and_export2>. The revisions which actually
> contain interesting changes are:
>
> http://
> http://
> http://
>
> I think I'm happy with the code now, so if you think these changes are sensible, I think I'll go ahead and merge them into trunk.
>
> Jean-Paul
>
> --
> https:/
> You are the owner of lp:~rick-fdd/pyopenssl/pkcs12_mod_and_export2.
--
Rick
| rick_dean (rick-fdd) wrote : | # |
My previous email was sent too early.
#149 I'm fine without a warning.
#156 Great catch. I hadn't noticed that PKCS12_parse()
would free the CA list, but not NULL it. For shame!
#157 Okay. Error paths are so hard to check.
A friend in a large company (that incidentally
uses a *lot* of python) says the culture there
is to always call exit() on errors. You can
log a message first if you like, but don't bother
wasting code on an error path which is futile
to get right.
--
Rick
On Sun, Jul 26, 2009 at 01:57:57AM -0000, Jean-Paul Calderone wrote:
> >
> > Excellent points! Thanks for the lesson. I pushed all five
> > fixes to lp:~rick-fdd/pyopenssl/pkcs12_mod_and_export2
> >
>
> Awesome, thanks for all your work on this. :) I made a bunch of cosmetic changes (I should put
> together a style guide for pyOpenSSL, but I'm still not sure what it would say), but notices a
> couple more actual potential issues, which I also tried to tackle. My changes are in a branch
> based on yours, <lp:~exarkun/pyopenssl/pkcs12_mod_and_export2>. The revisions which actually
> contain interesting changes are:
>
> http://
> http://
> http://
>
> I think I'm happy with the code now, so if you think these changes are sensible, I think I'll go ahead and merge them into trunk.
>
> Jean-Paul
>
> --
> https:/
> You are the owner of lp:~rick-fdd/pyopenssl/pkcs12_mod_and_export2.
--
Rick
| Jean-Paul Calderone (exarkun) wrote : | # |
>
> I didn't know whose curly bracket style that was, yours
> or openssl's. As long as we don't adopt the thousand
> line function style of openssl, I'll be happy. :-)
>
> #149 looks good. If Py_BuildValue returned NULL, it
> was like the alias didn't exist. I contemplated an
> error message, but chose not to. With the new code
> maybe we should.
>
I wasn't sure how that Py_BuildValue might be induced to fail. I thought it would have to be
an internal CPython malloc failure or something like that. If the alias doesn't exist, doesn't
that mean the whole block with Py_BuildValue will be skipped? Or am I misunderstanding something?
Jean-Paul
| Jean-Paul Calderone (exarkun) wrote : | # |
>
> My previous email was sent too early.
>
Oops, didn't see this message before posting my last message. :)
> #149 I'm fine without a warning.
>
> #156 Great catch. I hadn't noticed that PKCS12_parse()
> would free the CA list, but not NULL it. For shame!
>
> #157 Okay. Error paths are so hard to check.
> A friend in a large company (that incidentally
> uses a *lot* of python) says the culture there
> is to always call exit() on errors. You can
> log a message first if you like, but don't bother
> wasting code on an error path which is futile
> to get right.
>
Luckily for me, you basically provided the test case for this error path. :) I probably wouldn't have noticed these problems if not for the commented-out attempt to load that MAC-less PKCS12 blob in one of the tests you wrote. From there, it wasn't too hard to figure out what the fix was. Of course, since the OpenSSL API is so bleh, there may be some other case that's still not tested and doesn't work right... If I were going to pursue a rigorous testing policy for this code, I'd probably start by collecting a lot of PKCS12 data from a variety of sources and run them all through these pyOpenSSL APIs as part of the automated test suite. Off the top of my head, I'm not sure where to go to find such data, though (I guess web browsers can spit it out somehow? Or do they only load it?).
I think the current level of test coverage is good, even if it's not perfect. Problems discovered later can be fixed later. :)
I'm sort of a fan of exiting immediately on errors, at least in certain circumstances. I'd feel really bad putting that into a Python library, since I don't think most Python programmers expect libraries to do that. Maybe it's actually worth doing for error paths that we're not able to construct tests for. If people run into them in practice, that behavior would be a good motivation for them to construct a test case and contribute it back to the project. :) For the time being though, I'll probably leave things as-is.
> --
> Rick
>
> On Sun, Jul 26, 2009 at 01:57:57AM -0000, Jean-Paul Calderone wrote:
> > >
> > > Excellent points! Thanks for the lesson. I pushed all five
> > > fixes to lp:~rick-fdd/pyopenssl/pkcs12_mod_and_export2
> > >
> >
> > Awesome, thanks for all your work on this. :) I made a bunch of cosmetic
> changes (I should put
> > together a style guide for pyOpenSSL, but I'm still not sure what it would
> say), but notices a
> > couple more actual potential issues, which I also tried to tackle. My
> changes are in a branch
> > based on yours, <lp:~exarkun/pyopenssl/pkcs12_mod_and_export2>. The
> revisions which actually
> > contain interesting changes are:
> >
> > http://
> sion/149
> > http://
> sion/156
> > http://
> sion/157
> >
> > I think I'm happy with the code now, so if you think these changes are
> sensible, I think I'll go ahead and merge them into trunk.
> >
> > Jean-Paul
> >
> > --
> > https:/
>...
| rick_dean (rick-fdd) wrote : | # |
Agreed that pyOpenSSL should avoid exit().
Agreed the code is ready to be committed.
It does not break any old functionality, and the
API is stable.
There is a difference between testing the
bindings and testing openssl. The unit tests
are responsible for the former, yet they
do some of the later.
--
Rick
On Sun, Jul 26, 2009 at 02:14:18PM -0000, Jean-Paul Calderone wrote:
> >
> > My previous email was sent too early.
> >
>
> Oops, didn't see this message before posting my last message. :)
>
> > #149 I'm fine without a warning.
> >
> > #156 Great catch. I hadn't noticed that PKCS12_parse()
> > would free the CA list, but not NULL it. For shame!
> >
> > #157 Okay. Error paths are so hard to check.
> > A friend in a large company (that incidentally
> > uses a *lot* of python) says the culture there
> > is to always call exit() on errors. You can
> > log a message first if you like, but don't bother
> > wasting code on an error path which is futile
> > to get right.
> >
>
> Luckily for me, you basically provided the test case for this error path. :) I probably wouldn't have noticed these problems if not for the commented-out attempt to load that MAC-less PKCS12 blob in one of the tests you wrote. From there, it wasn't too hard to figure out what the fix was. Of course, since the OpenSSL API is so bleh, there may be some other case that's still not tested and doesn't work right... If I were going to pursue a rigorous testing policy for this code, I'd probably start by collecting a lot of PKCS12 data from a variety of sources and run them all through these pyOpenSSL APIs as part of the automated test suite. Off the top of my head, I'm not sure where to go to find such data, though (I guess web browsers can spit it out somehow? Or do they only load it?).
>
> I think the current level of test coverage is good, even if it's not perfect. Problems discovered later can be fixed later. :)
>
> I'm sort of a fan of exiting immediately on errors, at least in certain circumstances. I'd feel really bad putting that into a Python library, since I don't think most Python programmers expect libraries to do that. Maybe it's actually worth doing for error paths that we're not able to construct tests for. If people run into them in practice, that behavior would be a good motivation for them to construct a test case and contribute it back to the project. :) For the time being though, I'll probably leave things as-is.
>
>
> > --
> > Rick
> >
> > On Sun, Jul 26, 2009 at 01:57:57AM -0000, Jean-Paul Calderone wrote:
> > > >
> > > > Excellent points! Thanks for the lesson. I pushed all five
> > > > fixes to lp:~rick-fdd/pyopenssl/pkcs12_mod_and_export2
> > > >
> > >
> > > Awesome, thanks for all your work on this. :) I made a bunch of cosmetic
> > changes (I should put
> > > together a style guide for pyOpenSSL, but I'm still not sure what it would
> > say), but notices a
> > > couple more actual potential issues, which I also tried to tackle. My
> > changes are in a branch
> > > based on yours, <lp:~exarkun/pyopenssl/pkcs12_mod_and_export2>. The
> > revisions which actually
> > > contain interesting changes are:
> > >
> > > ht...
| rick_dean (rick-fdd) wrote : | # |
Yes, I was thinking of malloc as the likely Py_BuildValue()
failure. Either we drop the friendly name, or abort the
whole method. I don't care much, as long as we haven't
leaked or corrupted memory, which keeps me happy.
If Py_BuildValue() fails, then an exception is likely
futile anyway.
--
Rick
On Sun, Jul 26, 2009 at 02:04:30PM -0000, Jean-Paul Calderone wrote:
> >
> > I didn't know whose curly bracket style that was, yours
> > or openssl's. As long as we don't adopt the thousand
> > line function style of openssl, I'll be happy. :-)
> >
> > #149 looks good. If Py_BuildValue returned NULL, it
> > was like the alias didn't exist. I contemplated an
> > error message, but chose not to. With the new code
> > maybe we should.
> >
>
> I wasn't sure how that Py_BuildValue might be induced to fail. I thought it would have to be
> an internal CPython malloc failure or something like that. If the alias doesn't exist, doesn't
> that mean the whole block with Py_BuildValue will be skipped? Or am I misunderstanding something?
>
> Jean-Paul
>
> --
> https:/
> You are the owner of lp:~rick-fdd/pyopenssl/pkcs12_mod_and_export2.
| Jean-Paul Calderone (exarkun) wrote : | # |
Accepted this a while ago.
Preview Diff
| 1 | === modified file 'doc/pyOpenSSL.tex' | |||
| 2 | --- doc/pyOpenSSL.tex 2009-07-16 18:09:53 +0000 | |||
| 3 | +++ doc/pyOpenSSL.tex 2009-07-17 19:49:48 +0000 | |||
| 4 | @@ -524,6 +524,19 @@ | |||
| 5 | 524 | 524 | ||
| 6 | 525 | PKCS12 objects have the following methods: | 525 | PKCS12 objects have the following methods: |
| 7 | 526 | 526 | ||
| 8 | 527 | \begin{methoddesc}[PKCS12]{export}{\optional{passphrase=None}\optional{, friendly_name=None}\optional{, iter=2000}\optional{, maciter=0}} | ||
| 9 | 528 | Returns a PKCS12 object as a string. | ||
| 10 | 529 | |||
| 11 | 530 | The optional \var{passphrase} must be a string not a callback. | ||
| 12 | 531 | |||
| 13 | 532 | See also the man page for the C function \function{PKCS12_create}. | ||
| 14 | 533 | \end{methoddesc} | ||
| 15 | 534 | |||
| 16 | 535 | \begin{methoddesc}[PKCS12]{get_ca_certificates}{} | ||
| 17 | 536 | Return CA certificates within the PKCS12 object as a tuple. Returns | ||
| 18 | 537 | \constant{None} if no CA certificates are present. | ||
| 19 | 538 | \end{methoddesc} | ||
| 20 | 539 | |||
| 21 | 527 | \begin{methoddesc}[PKCS12]{get_certificate}{} | 540 | \begin{methoddesc}[PKCS12]{get_certificate}{} |
| 22 | 528 | Return certificate portion of the PKCS12 structure. | 541 | Return certificate portion of the PKCS12 structure. |
| 23 | 529 | \end{methoddesc} | 542 | \end{methoddesc} |
| 24 | @@ -532,9 +545,18 @@ | |||
| 25 | 532 | Return private key portion of the PKCS12 structure | 545 | Return private key portion of the PKCS12 structure |
| 26 | 533 | \end{methoddesc} | 546 | \end{methoddesc} |
| 27 | 534 | 547 | ||
| 31 | 535 | \begin{methoddesc}[PKCS12]{get_ca_certificates}{} | 548 | \begin{methoddesc}[PKCS12]{set_ca_certificates}{cacerts} |
| 32 | 536 | Return CA certificates within the PKCS12 object as a tuple. Returns | 549 | Replace or set the CA certificates within the PKCS12 object with the sequence \var{cacerts}. |
| 33 | 537 | None if no CA certificates are present. | 550 | |
| 34 | 551 | Set \var{cacerts} to \constant{None} to remove all CA certificates. | ||
| 35 | 552 | \end{methoddesc} | ||
| 36 | 553 | |||
| 37 | 554 | \begin{methoddesc}[PKCS12]{set_certificate}{cert} | ||
| 38 | 555 | Replace or set the certificate portion of the PKCS12 structure. | ||
| 39 | 556 | \end{methoddesc} | ||
| 40 | 557 | |||
| 41 | 558 | \begin{methoddesc}[PKCS12]{set_privatekey}{pkey} | ||
| 42 | 559 | Replace or set private key portion of the PKCS12 structure | ||
| 43 | 538 | \end{methoddesc} | 560 | \end{methoddesc} |
| 44 | 539 | 561 | ||
| 45 | 540 | \subsubsection{X509Extension objects \label{openssl-509ext}} | 562 | \subsubsection{X509Extension objects \label{openssl-509ext}} |
| 46 | 541 | 563 | ||
| 47 | === modified file 'src/crypto/crypto.c' | |||
| 48 | --- src/crypto/crypto.c 2009-07-16 20:25:19 +0000 | |||
| 49 | +++ src/crypto/crypto.c 2009-07-17 17:50:12 +0000 | |||
| 50 | @@ -12,6 +12,7 @@ | |||
| 51 | 12 | #include <Python.h> | 12 | #include <Python.h> |
| 52 | 13 | #define crypto_MODULE | 13 | #define crypto_MODULE |
| 53 | 14 | #include "crypto.h" | 14 | #include "crypto.h" |
| 54 | 15 | #include "pkcs12.h" | ||
| 55 | 15 | 16 | ||
| 56 | 16 | static char crypto_doc[] = "\n\ | 17 | static char crypto_doc[] = "\n\ |
| 57 | 17 | Main file of crypto sub module.\n\ | 18 | Main file of crypto sub module.\n\ |
| 58 | @@ -493,7 +494,6 @@ | |||
| 59 | 493 | static PyObject * | 494 | static PyObject * |
| 60 | 494 | crypto_load_pkcs12(PyObject *spam, PyObject *args) | 495 | crypto_load_pkcs12(PyObject *spam, PyObject *args) |
| 61 | 495 | { | 496 | { |
| 62 | 496 | crypto_PKCS12Obj *crypto_PKCS12_New(PKCS12 *, char *); | ||
| 63 | 497 | int len; | 497 | int len; |
| 64 | 498 | char *buffer, *passphrase = NULL; | 498 | char *buffer, *passphrase = NULL; |
| 65 | 499 | BIO *bio; | 499 | BIO *bio; |
| 66 | 500 | 500 | ||
| 67 | === modified file 'src/crypto/pkcs12.c' | |||
| 68 | --- src/crypto/pkcs12.c 2009-07-08 16:48:33 +0000 | |||
| 69 | +++ src/crypto/pkcs12.c 2009-07-17 20:21:23 +0000 | |||
| 70 | @@ -36,19 +36,84 @@ | |||
| 71 | 36 | return self->cert; | 36 | return self->cert; |
| 72 | 37 | } | 37 | } |
| 73 | 38 | 38 | ||
| 74 | 39 | static char crypto_PKCS12_set_certificate_doc[] = "\n\ | ||
| 75 | 40 | Replace the certificate portion of the PKCS12 structure\n\ | ||
| 76 | 41 | \n\ | ||
| 77 | 42 | @param cert: The new certificate.\n\ | ||
| 78 | 43 | @type cert: L{X509}\n\ | ||
| 79 | 44 | @return: X509 object containing the certificate\n\ | ||
| 80 | 45 | "; | ||
| 81 | 46 | static crypto_PKCS12Obj * | ||
| 82 | 47 | crypto_PKCS12_set_certificate(crypto_PKCS12Obj *self, PyObject *args, PyObject *keywds) | ||
| 83 | 48 | { | ||
| 84 | 49 | PyObject *cert = NULL; | ||
| 85 | 50 | static char *kwlist[] = {"cert", NULL}; | ||
| 86 | 51 | |||
| 87 | 52 | if (!PyArg_ParseTupleAndKeywords(args, keywds, "O:set_certificate", | ||
| 88 | 53 | kwlist, &cert)) | ||
| 89 | 54 | return NULL; | ||
| 90 | 55 | |||
| 91 | 56 | if (cert != Py_None && ! PyObject_IsInstance(cert, (PyObject *) &crypto_X509_Type)) { | ||
| 92 | 57 | PyErr_SetString(PyExc_TypeError, "cert must be type X509 or None"); | ||
| 93 | 58 | return NULL; | ||
| 94 | 59 | } | ||
| 95 | 60 | |||
| 96 | 61 | Py_INCREF(cert); /* Make consistent before calling Py_DECREF() */ | ||
| 97 | 62 | if(self->cert) { | ||
| 98 | 63 | Py_DECREF(self->cert); | ||
| 99 | 64 | } | ||
| 100 | 65 | self->cert = cert; | ||
| 101 | 66 | |||
| 102 | 67 | Py_INCREF(self); | ||
| 103 | 68 | return self; | ||
| 104 | 69 | } | ||
| 105 | 70 | |||
| 106 | 39 | static char crypto_PKCS12_get_privatekey_doc[] = "\n\ | 71 | static char crypto_PKCS12_get_privatekey_doc[] = "\n\ |
| 107 | 40 | Return private key portion of the PKCS12 structure\n\ | 72 | Return private key portion of the PKCS12 structure\n\ |
| 108 | 41 | \n\ | 73 | \n\ |
| 109 | 42 | @returns: PKey object containing the private key\n\ | 74 | @returns: PKey object containing the private key\n\ |
| 110 | 43 | "; | 75 | "; |
| 112 | 44 | static PyObject * | 76 | //static PyObject * |
| 113 | 77 | static crypto_PKeyObj * | ||
| 114 | 45 | crypto_PKCS12_get_privatekey(crypto_PKCS12Obj *self, PyObject *args) | 78 | crypto_PKCS12_get_privatekey(crypto_PKCS12Obj *self, PyObject *args) |
| 115 | 46 | { | 79 | { |
| 116 | 47 | if (!PyArg_ParseTuple(args, ":get_privatekey")) | 80 | if (!PyArg_ParseTuple(args, ":get_privatekey")) |
| 117 | 48 | return NULL; | 81 | return NULL; |
| 118 | 49 | 82 | ||
| 119 | 50 | Py_INCREF(self->key); | 83 | Py_INCREF(self->key); |
| 121 | 51 | return self->key; | 84 | return (crypto_PKeyObj *) self->key; |
| 122 | 85 | } | ||
| 123 | 86 | |||
| 124 | 87 | static char crypto_PKCS12_set_privatekey_doc[] = "\n\ | ||
| 125 | 88 | Replace or set the certificate portion of the PKCS12 structure\n\ | ||
| 126 | 89 | \n\ | ||
| 127 | 90 | @param pkey: The new private key.\n\ | ||
| 128 | 91 | @type pkey: L{PKey}\n\ | ||
| 129 | 92 | @return: None\n\ | ||
| 130 | 93 | "; | ||
| 131 | 94 | static crypto_PKCS12Obj * | ||
| 132 | 95 | crypto_PKCS12_set_privatekey(crypto_PKCS12Obj *self, PyObject *args, PyObject *keywds) | ||
| 133 | 96 | { | ||
| 134 | 97 | PyObject *pkey = NULL; | ||
| 135 | 98 | static char *kwlist[] = {"pkey", NULL}; | ||
| 136 | 99 | |||
| 137 | 100 | if (!PyArg_ParseTupleAndKeywords(args, keywds, "O:set_privatekey", | ||
| 138 | 101 | kwlist, &pkey)) | ||
| 139 | 102 | return NULL; | ||
| 140 | 103 | |||
| 141 | 104 | if (pkey != Py_None && ! PyObject_IsInstance(pkey, (PyObject *) &crypto_PKey_Type)) { | ||
| 142 | 105 | PyErr_SetString(PyExc_TypeError, "pkey must be type X509 or None"); | ||
| 143 | 106 | return NULL; | ||
| 144 | 107 | } | ||
| 145 | 108 | |||
| 146 | 109 | Py_INCREF(pkey); /* Make consistent before calling Py_DECREF() */ | ||
| 147 | 110 | if(self->key) { | ||
| 148 | 111 | Py_DECREF(self->key); | ||
| 149 | 112 | } | ||
| 150 | 113 | self->key = pkey; | ||
| 151 | 114 | |||
| 152 | 115 | Py_INCREF(self); | ||
| 153 | 116 | return self; | ||
| 154 | 52 | } | 117 | } |
| 155 | 53 | 118 | ||
| 156 | 54 | static char crypto_PKCS12_get_ca_certificates_doc[] = "\n\ | 119 | static char crypto_PKCS12_get_ca_certificates_doc[] = "\n\ |
| 157 | @@ -67,6 +132,118 @@ | |||
| 158 | 67 | return self->cacerts; | 132 | return self->cacerts; |
| 159 | 68 | } | 133 | } |
| 160 | 69 | 134 | ||
| 161 | 135 | static char crypto_PKCS12_set_ca_certificates_doc[] = "\n\ | ||
| 162 | 136 | Replace or set the CA certificates withing the PKCS12 object.\n\ | ||
| 163 | 137 | \n\ | ||
| 164 | 138 | @param cacerts: The new CA certificates.\n\ | ||
| 165 | 139 | @type cacerts: Sequence of L{X509}\n\ | ||
| 166 | 140 | @return: None\n\ | ||
| 167 | 141 | "; | ||
| 168 | 142 | static crypto_PKCS12Obj * | ||
| 169 | 143 | crypto_PKCS12_set_ca_certificates(crypto_PKCS12Obj *self, PyObject *args, PyObject *keywds) | ||
| 170 | 144 | { | ||
| 171 | 145 | PyObject *cacerts; | ||
| 172 | 146 | static char *kwlist[] = {"cacerts", NULL}; | ||
| 173 | 147 | int i; /* Py_ssize_t for Python 2.5+ */ | ||
| 174 | 148 | |||
| 175 | 149 | if (!PyArg_ParseTupleAndKeywords(args, keywds, "O:set_ca_certificates", | ||
| 176 | 150 | kwlist, &cacerts)) | ||
| 177 | 151 | return NULL; | ||
| 178 | 152 | if (cacerts == Py_None) { | ||
| 179 | 153 | /* We are good. */ | ||
| 180 | 154 | } else if (PySequence_Check(cacerts)) { /* is iterable */ | ||
| 181 | 155 | for(i = 0;i < PySequence_Length(cacerts);i++) { /* For each CA cert */ | ||
| 182 | 156 | PyObject *obj; | ||
| 183 | 157 | obj = PySequence_GetItem(cacerts, i); | ||
| 184 | 158 | if (PyObject_Type(obj) != (PyObject *) &crypto_X509_Type) { | ||
| 185 | 159 | Py_DECREF(obj); | ||
| 186 | 160 | PyErr_SetString(PyExc_TypeError, "cacerts iterable must only contain X509Type"); | ||
| 187 | 161 | return NULL; | ||
| 188 | 162 | } | ||
| 189 | 163 | Py_DECREF(obj); | ||
| 190 | 164 | } | ||
| 191 | 165 | } else { | ||
| 192 | 166 | PyErr_SetString(PyExc_TypeError, "cacerts must be an iterable or None"); | ||
| 193 | 167 | return NULL; | ||
| 194 | 168 | } | ||
| 195 | 169 | |||
| 196 | 170 | Py_INCREF(cacerts); /* Make consistent before calling Py_DECREF() */ | ||
| 197 | 171 | if(self->cacerts) { | ||
| 198 | 172 | Py_DECREF(self->cacerts); | ||
| 199 | 173 | } | ||
| 200 | 174 | self->cacerts = cacerts; | ||
| 201 | 175 | |||
| 202 | 176 | Py_INCREF(self); | ||
| 203 | 177 | return self; | ||
| 204 | 178 | } | ||
| 205 | 179 | |||
| 206 | 180 | static char crypto_PKCS12_export_doc[] = "\n\ | ||
| 207 | 181 | export([passphrase=None][, friendly_name=None][, iter=2048][, maciter=1]\n\ | ||
| 208 | 182 | Dump a PKCS12 object as a string. See also \"man PKCS12_create\".\n\ | ||
| 209 | 183 | \n\ | ||
| 210 | 184 | @param passphrase: used to encrypt the PKCS12\n\ | ||
| 211 | 185 | @type passphrase: L{str}\n\ | ||
| 212 | 186 | @param friendly_name: A descriptive comment\n\ | ||
| 213 | 187 | @type friendly_name: L{str}\n\ | ||
| 214 | 188 | @param iter: How many times to repeat the encryption\n\ | ||
| 215 | 189 | @type iter: L{int}\n\ | ||
| 216 | 190 | @param maciter: How many times to repeat the MAC\n\ | ||
| 217 | 191 | @type maciter: L{int}\n\ | ||
| 218 | 192 | @return: The string containing the PKCS12\n\ | ||
| 219 | 193 | "; | ||
| 220 | 194 | static PyObject * | ||
| 221 | 195 | crypto_PKCS12_export(crypto_PKCS12Obj *self, PyObject *args, PyObject *keywds) | ||
| 222 | 196 | { | ||
| 223 | 197 | int buf_len; | ||
| 224 | 198 | PyObject *buffer; | ||
| 225 | 199 | char *temp, *passphrase = NULL, *friendly_name = NULL; | ||
| 226 | 200 | BIO *bio; | ||
| 227 | 201 | PKCS12 *p12; | ||
| 228 | 202 | EVP_PKEY *pkey = NULL; | ||
| 229 | 203 | STACK_OF(X509) *cacerts = NULL; | ||
| 230 | 204 | X509 *x509 = NULL; | ||
| 231 | 205 | int iter = 0; /* defaults to PKCS12_DEFAULT_ITER */ | ||
| 232 | 206 | int maciter = 0; | ||
| 233 | 207 | static char *kwlist[] = {"passphrase", "friendly_name", "iter", "maciter", NULL}; | ||
| 234 | 208 | |||
| 235 | 209 | if (!PyArg_ParseTupleAndKeywords(args, keywds, "|zzii:export", | ||
| 236 | 210 | kwlist, &passphrase, &friendly_name, &iter, &maciter)) | ||
| 237 | 211 | return NULL; | ||
| 238 | 212 | |||
| 239 | 213 | if (self->key && self->key != Py_None) { | ||
| 240 | 214 | pkey = ((crypto_PKeyObj*) self->key)->pkey; | ||
| 241 | 215 | } | ||
| 242 | 216 | if (self->cert && self->cert != Py_None) { | ||
| 243 | 217 | x509 = ((crypto_X509Obj*) self->cert)->x509; | ||
| 244 | 218 | } | ||
| 245 | 219 | cacerts = sk_X509_new_null(); | ||
| 246 | 220 | if (self->cacerts && self->cacerts != Py_None) { | ||
| 247 | 221 | int i; /* Py_ssize_t for Python 2.5+ */ | ||
| 248 | 222 | PyObject *obj; | ||
| 249 | 223 | for(i = 0;i < PySequence_Length(self->cacerts);i++) { /* For each CA cert */ | ||
| 250 | 224 | obj = PySequence_GetItem(self->cacerts, i); | ||
| 251 | 225 | /* assert(PyObject_IsInstance(obj, (PyObject *) &crypto_X509_Type )); */ | ||
| 252 | 226 | sk_X509_push(cacerts, (( crypto_X509Obj* ) obj)->x509); | ||
| 253 | 227 | Py_DECREF(obj); | ||
| 254 | 228 | } | ||
| 255 | 229 | } | ||
| 256 | 230 | |||
| 257 | 231 | p12 = PKCS12_create(passphrase, friendly_name, pkey, x509, cacerts, | ||
| 258 | 232 | NID_pbe_WithSHA1And3_Key_TripleDES_CBC, | ||
| 259 | 233 | NID_pbe_WithSHA1And3_Key_TripleDES_CBC, | ||
| 260 | 234 | iter, maciter, 0); | ||
| 261 | 235 | if( p12 == NULL ) { | ||
| 262 | 236 | exception_from_error_queue(crypto_Error); | ||
| 263 | 237 | return NULL; | ||
| 264 | 238 | } | ||
| 265 | 239 | bio = BIO_new(BIO_s_mem()); | ||
| 266 | 240 | i2d_PKCS12_bio(bio, p12); | ||
| 267 | 241 | buf_len = BIO_get_mem_data(bio, &temp); | ||
| 268 | 242 | buffer = PyString_FromStringAndSize(temp, buf_len); | ||
| 269 | 243 | BIO_free(bio); | ||
| 270 | 244 | return buffer; | ||
| 271 | 245 | } | ||
| 272 | 246 | |||
| 273 | 70 | /* | 247 | /* |
| 274 | 71 | * ADD_METHOD(name) expands to a correct PyMethodDef declaration | 248 | * ADD_METHOD(name) expands to a correct PyMethodDef declaration |
| 275 | 72 | * { 'name', (PyCFunction)crypto_PKCS12_name, METH_VARARGS, crypto_PKCS12_name_doc } | 249 | * { 'name', (PyCFunction)crypto_PKCS12_name, METH_VARARGS, crypto_PKCS12_name_doc } |
| 276 | @@ -74,11 +251,17 @@ | |||
| 277 | 74 | */ | 251 | */ |
| 278 | 75 | #define ADD_METHOD(name) \ | 252 | #define ADD_METHOD(name) \ |
| 279 | 76 | { #name, (PyCFunction)crypto_PKCS12_##name, METH_VARARGS, crypto_PKCS12_##name##_doc } | 253 | { #name, (PyCFunction)crypto_PKCS12_##name, METH_VARARGS, crypto_PKCS12_##name##_doc } |
| 280 | 254 | #define ADD_KW_METHOD(name) \ | ||
| 281 | 255 | { #name, (PyCFunction)crypto_PKCS12_##name, METH_VARARGS | METH_KEYWORDS, crypto_PKCS12_##name##_doc } | ||
| 282 | 77 | static PyMethodDef crypto_PKCS12_methods[] = | 256 | static PyMethodDef crypto_PKCS12_methods[] = |
| 283 | 78 | { | 257 | { |
| 284 | 79 | ADD_METHOD(get_certificate), | 258 | ADD_METHOD(get_certificate), |
| 285 | 259 | ADD_KW_METHOD(set_certificate), | ||
| 286 | 80 | ADD_METHOD(get_privatekey), | 260 | ADD_METHOD(get_privatekey), |
| 287 | 261 | ADD_KW_METHOD(set_privatekey), | ||
| 288 | 81 | ADD_METHOD(get_ca_certificates), | 262 | ADD_METHOD(get_ca_certificates), |
| 289 | 263 | ADD_KW_METHOD(set_ca_certificates), | ||
| 290 | 264 | ADD_KW_METHOD(export), | ||
| 291 | 82 | { NULL, NULL } | 265 | { NULL, NULL } |
| 292 | 83 | }; | 266 | }; |
| 293 | 84 | #undef ADD_METHOD | 267 | #undef ADD_METHOD |
| 294 | @@ -108,7 +291,7 @@ | |||
| 295 | 108 | cacerts = sk_X509_new_null(); | 291 | cacerts = sk_X509_new_null(); |
| 296 | 109 | 292 | ||
| 297 | 110 | /* parse the PKCS12 lump */ | 293 | /* parse the PKCS12 lump */ |
| 299 | 111 | if (!(cacerts && PKCS12_parse(p12, passphrase, &pkey, &cert, &cacerts))) | 294 | if (p12 && !(cacerts && PKCS12_parse(p12, passphrase, &pkey, &cert, &cacerts))) |
| 300 | 112 | { | 295 | { |
| 301 | 113 | exception_from_error_queue(crypto_Error); | 296 | exception_from_error_queue(crypto_Error); |
| 302 | 114 | return NULL; | 297 | return NULL; |
| 303 | @@ -122,11 +305,20 @@ | |||
| 304 | 122 | Py_INCREF(Py_None); | 305 | Py_INCREF(Py_None); |
| 305 | 123 | self->cacerts = Py_None; | 306 | self->cacerts = Py_None; |
| 306 | 124 | 307 | ||
| 312 | 125 | if ((self->cert = (PyObject *)crypto_X509_New(cert, 1)) == NULL) | 308 | if (cert == NULL) { |
| 313 | 126 | goto error; | 309 | Py_INCREF(Py_None); |
| 314 | 127 | 310 | self->cert = Py_None; | |
| 315 | 128 | if ((self->key = (PyObject *)crypto_PKey_New(pkey, 1)) == NULL) | 311 | } else { |
| 316 | 129 | goto error; | 312 | if ((self->cert = (PyObject *)crypto_X509_New(cert, 1)) == NULL) |
| 317 | 313 | goto error; | ||
| 318 | 314 | } | ||
| 319 | 315 | if (pkey == NULL) { | ||
| 320 | 316 | Py_INCREF(Py_None); | ||
| 321 | 317 | self->key = Py_None; | ||
| 322 | 318 | } else { | ||
| 323 | 319 | if ((self->key = (PyObject *)crypto_PKey_New(pkey, 1)) == NULL) | ||
| 324 | 320 | goto error; | ||
| 325 | 321 | } | ||
| 326 | 130 | 322 | ||
| 327 | 131 | /* Make a tuple for the CA certs */ | 323 | /* Make a tuple for the CA certs */ |
| 328 | 132 | cacert_count = sk_X509_num(cacerts); | 324 | cacert_count = sk_X509_num(cacerts); |
| 329 | @@ -154,6 +346,23 @@ | |||
| 330 | 154 | return NULL; | 346 | return NULL; |
| 331 | 155 | } | 347 | } |
| 332 | 156 | 348 | ||
| 333 | 349 | static char crypto_PKCS12_doc[] = "\n\ | ||
| 334 | 350 | PKCS12() -> PKCS12 instance\n\ | ||
| 335 | 351 | \n\ | ||
| 336 | 352 | Create a new empty PKCS12 object.\n\ | ||
| 337 | 353 | \n\ | ||
| 338 | 354 | @returns: The PKCS12 object\n\ | ||
| 339 | 355 | "; | ||
| 340 | 356 | static PyObject * | ||
| 341 | 357 | crypto_PKCS12_new(PyTypeObject *subtype, PyObject *args, PyObject *kwargs) | ||
| 342 | 358 | { | ||
| 343 | 359 | if (!PyArg_ParseTuple(args, ":PKCS12")) { | ||
| 344 | 360 | return NULL; | ||
| 345 | 361 | } | ||
| 346 | 362 | |||
| 347 | 363 | return (PyObject *)crypto_PKCS12_New(NULL, NULL); | ||
| 348 | 364 | } | ||
| 349 | 365 | |||
| 350 | 157 | /* | 366 | /* |
| 351 | 158 | * Find attribute | 367 | * Find attribute |
| 352 | 159 | * | 368 | * |
| 353 | @@ -245,9 +454,24 @@ | |||
| 354 | 245 | NULL, /* setattro */ | 454 | NULL, /* setattro */ |
| 355 | 246 | NULL, /* as_buffer */ | 455 | NULL, /* as_buffer */ |
| 356 | 247 | Py_TPFLAGS_DEFAULT | Py_TPFLAGS_HAVE_GC, | 456 | Py_TPFLAGS_DEFAULT | Py_TPFLAGS_HAVE_GC, |
| 358 | 248 | NULL, /* doc */ | 457 | crypto_PKCS12_doc, |
| 359 | 249 | (traverseproc)crypto_PKCS12_traverse, | 458 | (traverseproc)crypto_PKCS12_traverse, |
| 360 | 250 | (inquiry)crypto_PKCS12_clear, | 459 | (inquiry)crypto_PKCS12_clear, |
| 361 | 460 | NULL, /* tp_richcompare */ | ||
| 362 | 461 | 0, /* tp_weaklistoffset */ | ||
| 363 | 462 | NULL, /* tp_iter */ | ||
| 364 | 463 | NULL, /* tp_iternext */ | ||
| 365 | 464 | crypto_PKCS12_methods, /* tp_methods */ | ||
| 366 | 465 | NULL, /* tp_members */ | ||
| 367 | 466 | NULL, /* tp_getset */ | ||
| 368 | 467 | NULL, /* tp_base */ | ||
| 369 | 468 | NULL, /* tp_dict */ | ||
| 370 | 469 | NULL, /* tp_descr_get */ | ||
| 371 | 470 | NULL, /* tp_descr_set */ | ||
| 372 | 471 | 0, /* tp_dictoffset */ | ||
| 373 | 472 | NULL, /* tp_init */ | ||
| 374 | 473 | NULL, /* tp_alloc */ | ||
| 375 | 474 | crypto_PKCS12_new, /* tp_new */ | ||
| 376 | 251 | }; | 475 | }; |
| 377 | 252 | 476 | ||
| 378 | 253 | /* | 477 | /* |
| 379 | @@ -262,6 +486,10 @@ | |||
| 380 | 262 | return 0; | 486 | return 0; |
| 381 | 263 | } | 487 | } |
| 382 | 264 | 488 | ||
| 383 | 489 | if (PyModule_AddObject(module, "PKCS12", (PyObject *)&crypto_PKCS12_Type) != 0) { | ||
| 384 | 490 | return 0; | ||
| 385 | 491 | } | ||
| 386 | 492 | |||
| 387 | 265 | if (PyModule_AddObject(module, "PKCS12Type", (PyObject *)&crypto_PKCS12_Type) != 0) { | 493 | if (PyModule_AddObject(module, "PKCS12Type", (PyObject *)&crypto_PKCS12_Type) != 0) { |
| 388 | 266 | return 0; | 494 | return 0; |
| 389 | 267 | } | 495 | } |
| 390 | 268 | 496 | ||
| 391 | === modified file 'src/crypto/pkcs12.h' | |||
| 392 | --- src/crypto/pkcs12.h 2008-02-19 01:50:23 +0000 | |||
| 393 | +++ src/crypto/pkcs12.h 2009-07-17 17:22:16 +0000 | |||
| 394 | @@ -27,4 +27,7 @@ | |||
| 395 | 27 | PyObject *cacerts; | 27 | PyObject *cacerts; |
| 396 | 28 | } crypto_PKCS12Obj; | 28 | } crypto_PKCS12Obj; |
| 397 | 29 | 29 | ||
| 398 | 30 | crypto_PKCS12Obj * | ||
| 399 | 31 | crypto_PKCS12_New(PKCS12 *p12, char *passphrase); | ||
| 400 | 32 | |||
| 401 | 30 | #endif | 33 | #endif |
| 402 | 31 | 34 | ||
| 403 | === modified file 'test/test_crypto.py' | |||
| 404 | --- test/test_crypto.py 2009-07-05 16:54:05 +0000 | |||
| 405 | +++ test/test_crypto.py 2009-07-17 20:05:22 +0000 | |||
| 406 | @@ -17,11 +17,10 @@ | |||
| 407 | 17 | from OpenSSL.crypto import dump_certificate, load_certificate_request | 17 | from OpenSSL.crypto import dump_certificate, load_certificate_request |
| 408 | 18 | from OpenSSL.crypto import dump_certificate_request, dump_privatekey | 18 | from OpenSSL.crypto import dump_certificate_request, dump_privatekey |
| 409 | 19 | from OpenSSL.crypto import PKCS7Type, load_pkcs7_data | 19 | from OpenSSL.crypto import PKCS7Type, load_pkcs7_data |
| 411 | 20 | from OpenSSL.crypto import PKCS12Type, load_pkcs12 | 20 | from OpenSSL.crypto import PKCS12Type, load_pkcs12, PKCS12 |
| 412 | 21 | from OpenSSL.crypto import NetscapeSPKI, NetscapeSPKIType | 21 | from OpenSSL.crypto import NetscapeSPKI, NetscapeSPKIType |
| 413 | 22 | from OpenSSL.test.util import TestCase | 22 | from OpenSSL.test.util import TestCase |
| 414 | 23 | 23 | ||
| 415 | 24 | |||
| 416 | 25 | cleartextCertificatePEM = """-----BEGIN CERTIFICATE----- | 24 | cleartextCertificatePEM = """-----BEGIN CERTIFICATE----- |
| 417 | 26 | MIIC7TCCAlagAwIBAgIIPQzE4MbeufQwDQYJKoZIhvcNAQEFBQAwWDELMAkGA1UE | 25 | MIIC7TCCAlagAwIBAgIIPQzE4MbeufQwDQYJKoZIhvcNAQEFBQAwWDELMAkGA1UE |
| 418 | 27 | BhMCVVMxCzAJBgNVBAgTAklMMRAwDgYDVQQHEwdDaGljYWdvMRAwDgYDVQQKEwdU | 26 | BhMCVVMxCzAJBgNVBAgTAklMMRAwDgYDVQQHEwdDaGljYWdvMRAwDgYDVQQKEwdU |
| 419 | @@ -709,6 +708,123 @@ | |||
| 420 | 709 | cert = load_certificate(FILETYPE_PEM, self.pemData) | 708 | cert = load_certificate(FILETYPE_PEM, self.pemData) |
| 421 | 710 | self.assertEqual(cert.get_notBefore(), "20090325123658Z") | 709 | self.assertEqual(cert.get_notBefore(), "20090325123658Z") |
| 422 | 711 | 710 | ||
| 423 | 711 | class PKCS12Tests(TestCase): | ||
| 424 | 712 | """ | ||
| 425 | 713 | Tests functions in the L{OpenSSL.crypto.PKCS12} module. | ||
| 426 | 714 | """ | ||
| 427 | 715 | pemData = cleartextCertificatePEM + cleartextPrivateKeyPEM | ||
| 428 | 716 | |||
| 429 | 717 | def test_construction(self): | ||
| 430 | 718 | p12 = PKCS12() | ||
| 431 | 719 | self.assertEqual(None, p12.get_certificate()) | ||
| 432 | 720 | self.assertEqual(None, p12.get_privatekey()) | ||
| 433 | 721 | self.assertEqual(None, p12.get_ca_certificates()) | ||
| 434 | 722 | |||
| 435 | 723 | def test_type_errors(self): | ||
| 436 | 724 | p12 = PKCS12() | ||
| 437 | 725 | self.assertRaises(TypeError, p12.set_certificate, 3) | ||
| 438 | 726 | self.assertRaises(TypeError, p12.set_privatekey, 3) | ||
| 439 | 727 | self.assertRaises(TypeError, p12.set_ca_certificates, 3) | ||
| 440 | 728 | self.assertRaises(TypeError, p12.set_ca_certificates, X509()) | ||
| 441 | 729 | self.assertRaises(TypeError, p12.set_ca_certificates, (3, 4)) | ||
| 442 | 730 | |||
| 443 | 731 | def test_key_only(self): | ||
| 444 | 732 | """ | ||
| 445 | 733 | L{OpenSSL.crypto.PKCS12.export} and load a PKCS without a key | ||
| 446 | 734 | """ | ||
| 447 | 735 | passwd = 'blah' | ||
| 448 | 736 | p12 = PKCS12() | ||
| 449 | 737 | pkey = load_privatekey(FILETYPE_PEM, cleartextPrivateKeyPEM) | ||
| 450 | 738 | p12.set_privatekey( pkey ) | ||
| 451 | 739 | self.assertEqual(None, p12.get_certificate()) | ||
| 452 | 740 | self.assertEqual(pkey, p12.get_privatekey()) | ||
| 453 | 741 | dumped_p12 = p12.export(passphrase=passwd, iter=2, maciter=3) | ||
| 454 | 742 | p12 = load_pkcs12(dumped_p12, passwd) | ||
| 455 | 743 | self.assertEqual(None, p12.get_ca_certificates()) | ||
| 456 | 744 | self.assertEqual(None, p12.get_certificate()) | ||
| 457 | 745 | # It's actually in the pkcs12, but we silently don't find it (a key without a cert) | ||
| 458 | 746 | #self.assertEqual(cleartextPrivateKeyPEM, dump_privatekey(FILETYPE_PEM, p12.get_privatekey())) | ||
| 459 | 747 | |||
| 460 | 748 | def test_cert_only(self): | ||
| 461 | 749 | """ | ||
| 462 | 750 | L{OpenSSL.crypto.PKCS12.export} and load a PKCS without a key. | ||
| 463 | 751 | Strangely, OpenSSL converts it to a CA cert. | ||
| 464 | 752 | """ | ||
| 465 | 753 | passwd = 'blah' | ||
| 466 | 754 | p12 = PKCS12() | ||
| 467 | 755 | cert = load_certificate(FILETYPE_PEM, cleartextCertificatePEM) | ||
| 468 | 756 | p12.set_certificate( cert ) | ||
| 469 | 757 | self.assertEqual(cert, p12.get_certificate()) | ||
| 470 | 758 | self.assertEqual(None, p12.get_privatekey()) | ||
| 471 | 759 | dumped_p12 = p12.export(passphrase=passwd, iter=2, maciter=3) | ||
| 472 | 760 | p12 = load_pkcs12(dumped_p12, passwd) | ||
| 473 | 761 | self.assertEqual(None, p12.get_privatekey()) | ||
| 474 | 762 | self.assertEqual(None, p12.get_certificate()) | ||
| 475 | 763 | self.assertEqual(cleartextCertificatePEM, dump_certificate(FILETYPE_PEM, p12.get_ca_certificates()[0])) | ||
| 476 | 764 | |||
| 477 | 765 | |||
| 478 | 766 | def test_export_and_load(self): | ||
| 479 | 767 | """ | ||
| 480 | 768 | L{OpenSSL.crypto.PKCS12.export} and others | ||
| 481 | 769 | """ | ||
| 482 | 770 | # use openssl program to create a p12 then load it | ||
| 483 | 771 | from OpenSSL.test.test_ssl import client_cert_pem, client_key_pem, server_cert_pem, server_key_pem, root_cert_pem | ||
| 484 | 772 | passwd = 'whatever' | ||
| 485 | 773 | pem = client_key_pem + client_cert_pem | ||
| 486 | 774 | p12_str = _runopenssl(pem, "pkcs12", '-export', '-clcerts', '-passout', 'pass:'+passwd) | ||
| 487 | 775 | p12 = load_pkcs12(p12_str, passwd) | ||
| 488 | 776 | # verify p12 using pkcs12 get_* functions | ||
| 489 | 777 | cert_pem = dump_certificate(FILETYPE_PEM, p12.get_certificate()) | ||
| 490 | 778 | self.assertEqual(cert_pem, client_cert_pem) | ||
| 491 | 779 | key_pem = dump_privatekey(FILETYPE_PEM, p12.get_privatekey()) | ||
| 492 | 780 | self.assertEqual(key_pem, client_key_pem) | ||
| 493 | 781 | self.assertEqual(None, p12.get_ca_certificates()) | ||
| 494 | 782 | # dump cert and verify it using the openssl program | ||
| 495 | 783 | dumped_p12 = p12.export(passphrase=passwd, iter=2, maciter=0, friendly_name='blueberry') | ||
| 496 | 784 | recovered_key = _runopenssl(dumped_p12, "pkcs12", '-nocerts', '-nodes', '-passin', 'pass:'+passwd) | ||
| 497 | 785 | self.assertEqual(recovered_key[-len(client_key_pem):], client_key_pem) | ||
| 498 | 786 | recovered_cert = _runopenssl(dumped_p12, "pkcs12", '-clcerts', '-nodes', '-passin', 'pass:'+passwd, '-nokeys') | ||
| 499 | 787 | self.assertEqual(recovered_cert[-len(client_cert_pem):], client_cert_pem) | ||
| 500 | 788 | # change the cert and key | ||
| 501 | 789 | p12.set_certificate(load_certificate(FILETYPE_PEM, server_cert_pem)) | ||
| 502 | 790 | p12.set_privatekey(load_privatekey(FILETYPE_PEM, server_key_pem)) | ||
| 503 | 791 | root_cert = load_certificate(FILETYPE_PEM, root_cert_pem) | ||
| 504 | 792 | p12.set_ca_certificates( [ root_cert ] ) | ||
| 505 | 793 | p12.set_ca_certificates( ( root_cert, ) ) | ||
| 506 | 794 | self.assertEqual(1, len(p12.get_ca_certificates())) | ||
| 507 | 795 | self.assertEqual(root_cert, p12.get_ca_certificates()[0]) | ||
| 508 | 796 | # recover changed cert and key using the openssl program | ||
| 509 | 797 | dumped_p12 = p12.export(passphrase=passwd, iter=2, maciter=0, friendly_name='Serverlicious') | ||
| 510 | 798 | recovered_key = _runopenssl(dumped_p12, "pkcs12", '-nocerts', '-nodes', '-passin', 'pass:'+passwd) | ||
| 511 | 799 | self.assertEqual(recovered_key[-len(server_key_pem):], server_key_pem) | ||
| 512 | 800 | recovered_cert = _runopenssl(dumped_p12, "pkcs12", '-clcerts', '-nodes', '-passin', 'pass:'+passwd, '-nokeys') | ||
| 513 | 801 | self.assertEqual(recovered_cert[-len(server_cert_pem):], server_cert_pem) | ||
| 514 | 802 | recovered_cert = _runopenssl(dumped_p12, "pkcs12", '-cacerts', '-nodes', '-passin', 'pass:'+passwd, '-nokeys') | ||
| 515 | 803 | self.assertEqual(recovered_cert[-len(root_cert_pem):], root_cert_pem) | ||
| 516 | 804 | # Test other forms of no password | ||
| 517 | 805 | passwd = '' | ||
| 518 | 806 | dumped_p12_empty = p12.export(passphrase=passwd, iter=2, maciter=0, friendly_name='Sewer') | ||
| 519 | 807 | dumped_p12_none = p12.export(passphrase=None, iter=2, maciter=0, friendly_name='Sewer') | ||
| 520 | 808 | dumped_p12_nopw = p12.export( iter=2, maciter=0, friendly_name='Sewer') | ||
| 521 | 809 | recovered_empty = _runopenssl(dumped_p12_empty, "pkcs12", '-nodes', '-passin', 'pass:'+passwd ) | ||
| 522 | 810 | recovered_none = _runopenssl(dumped_p12_none, "pkcs12", '-nodes', '-passin', 'pass:'+passwd ) | ||
| 523 | 811 | recovered_nopw = _runopenssl(dumped_p12_nopw, "pkcs12", '-nodes', '-passin', 'pass:'+passwd ) | ||
| 524 | 812 | self.assertEqual(recovered_none, recovered_nopw) | ||
| 525 | 813 | self.assertEqual(recovered_none, recovered_empty) | ||
| 526 | 814 | # Test removing CA certs | ||
| 527 | 815 | p12.set_ca_certificates( None ) | ||
| 528 | 816 | self.assertEqual(None, p12.get_ca_certificates()) | ||
| 529 | 817 | # Test without MAC | ||
| 530 | 818 | dumped_p12 = p12.export(maciter=-1, passphrase=passwd, iter=2) | ||
| 531 | 819 | recovered_key = _runopenssl(dumped_p12, "pkcs12", '-nocerts', '-nodes', '-passin', 'pass:'+passwd, '-nomacver' ) | ||
| 532 | 820 | self.assertEqual(recovered_key[-len(server_key_pem):], server_key_pem) | ||
| 533 | 821 | # We can't load PKCS12 without MAC, because we use PCKS_parse() | ||
| 534 | 822 | #p12 = load_pkcs12(dumped_p12, passwd) | ||
| 535 | 823 | # Test export without any args | ||
| 536 | 824 | dumped_p12 = p12.export() | ||
| 537 | 825 | recovered_key = _runopenssl(dumped_p12, "pkcs12", '-nodes', '-passin', 'pass:' ) | ||
| 538 | 826 | self.assertEqual(recovered_key[-len(server_key_pem):], server_key_pem) | ||
| 539 | 827 | |||
| 540 | 712 | 828 | ||
| 541 | 713 | def test_get_notAfter(self): | 829 | def test_get_notAfter(self): |
| 542 | 714 | """ | 830 | """ |
| 543 | @@ -732,6 +848,18 @@ | |||
| 544 | 732 | 848 | ||
| 545 | 733 | 849 | ||
| 546 | 734 | 850 | ||
| 547 | 851 | def _runopenssl(pem, *args): | ||
| 548 | 852 | """ | ||
| 549 | 853 | Run the command line openssl tool with the given arguments and write | ||
| 550 | 854 | the given PEM to its stdin. | ||
| 551 | 855 | """ | ||
| 552 | 856 | write, read = popen2(" ".join(("openssl",) + args), "b") | ||
| 553 | 857 | write.write(pem) | ||
| 554 | 858 | write.close() | ||
| 555 | 859 | return read.read() | ||
| 556 | 860 | |||
| 557 | 861 | |||
| 558 | 862 | |||
| 559 | 735 | class FunctionTests(TestCase): | 863 | class FunctionTests(TestCase): |
| 560 | 736 | """ | 864 | """ |
| 561 | 737 | Tests for free-functions in the L{OpenSSL.crypto} module. | 865 | Tests for free-functions in the L{OpenSSL.crypto} module. |
| 562 | @@ -801,17 +929,6 @@ | |||
| 563 | 801 | self.assertEqual(loadedKey.bits(), key.bits()) | 929 | self.assertEqual(loadedKey.bits(), key.bits()) |
| 564 | 802 | 930 | ||
| 565 | 803 | 931 | ||
| 566 | 804 | def _runopenssl(self, pem, *args): | ||
| 567 | 805 | """ | ||
| 568 | 806 | Run the command line openssl tool with the given arguments and write | ||
| 569 | 807 | the given PEM to its stdin. | ||
| 570 | 808 | """ | ||
| 571 | 809 | write, read = popen2(" ".join(("openssl",) + args), "b") | ||
| 572 | 810 | write.write(pem) | ||
| 573 | 811 | write.close() | ||
| 574 | 812 | return read.read() | ||
| 575 | 813 | |||
| 576 | 814 | |||
| 577 | 815 | def test_dump_certificate(self): | 932 | def test_dump_certificate(self): |
| 578 | 816 | """ | 933 | """ |
| 579 | 817 | L{dump_certificate} writes PEM, DER, and text. | 934 | L{dump_certificate} writes PEM, DER, and text. |
| 580 | @@ -821,13 +938,13 @@ | |||
| 581 | 821 | dumped_pem = dump_certificate(FILETYPE_PEM, cert) | 938 | dumped_pem = dump_certificate(FILETYPE_PEM, cert) |
| 582 | 822 | self.assertEqual(dumped_pem, cleartextCertificatePEM) | 939 | self.assertEqual(dumped_pem, cleartextCertificatePEM) |
| 583 | 823 | dumped_der = dump_certificate(FILETYPE_ASN1, cert) | 940 | dumped_der = dump_certificate(FILETYPE_ASN1, cert) |
| 585 | 824 | good_der = self._runopenssl(dumped_pem, "x509", "-outform", "DER") | 941 | good_der = _runopenssl(dumped_pem, "x509", "-outform", "DER") |
| 586 | 825 | self.assertEqual(dumped_der, good_der) | 942 | self.assertEqual(dumped_der, good_der) |
| 587 | 826 | cert2 = load_certificate(FILETYPE_ASN1, dumped_der) | 943 | cert2 = load_certificate(FILETYPE_ASN1, dumped_der) |
| 588 | 827 | dumped_pem2 = dump_certificate(FILETYPE_PEM, cert2) | 944 | dumped_pem2 = dump_certificate(FILETYPE_PEM, cert2) |
| 589 | 828 | self.assertEqual(dumped_pem2, cleartextCertificatePEM) | 945 | self.assertEqual(dumped_pem2, cleartextCertificatePEM) |
| 590 | 829 | dumped_text = dump_certificate(FILETYPE_TEXT, cert) | 946 | dumped_text = dump_certificate(FILETYPE_TEXT, cert) |
| 592 | 830 | good_text = self._runopenssl(dumped_pem, "x509", "-noout", "-text") | 947 | good_text = _runopenssl(dumped_pem, "x509", "-noout", "-text") |
| 593 | 831 | self.assertEqual(dumped_text, good_text) | 948 | self.assertEqual(dumped_text, good_text) |
| 594 | 832 | 949 | ||
| 595 | 833 | 950 | ||
| 596 | @@ -840,13 +957,13 @@ | |||
| 597 | 840 | self.assertEqual(dumped_pem, cleartextPrivateKeyPEM) | 957 | self.assertEqual(dumped_pem, cleartextPrivateKeyPEM) |
| 598 | 841 | dumped_der = dump_privatekey(FILETYPE_ASN1, key) | 958 | dumped_der = dump_privatekey(FILETYPE_ASN1, key) |
| 599 | 842 | # XXX This OpenSSL call writes "writing RSA key" to standard out. Sad. | 959 | # XXX This OpenSSL call writes "writing RSA key" to standard out. Sad. |
| 601 | 843 | good_der = self._runopenssl(dumped_pem, "rsa", "-outform", "DER") | 960 | good_der = _runopenssl(dumped_pem, "rsa", "-outform", "DER") |
| 602 | 844 | self.assertEqual(dumped_der, good_der) | 961 | self.assertEqual(dumped_der, good_der) |
| 603 | 845 | key2 = load_privatekey(FILETYPE_ASN1, dumped_der) | 962 | key2 = load_privatekey(FILETYPE_ASN1, dumped_der) |
| 604 | 846 | dumped_pem2 = dump_privatekey(FILETYPE_PEM, key2) | 963 | dumped_pem2 = dump_privatekey(FILETYPE_PEM, key2) |
| 605 | 847 | self.assertEqual(dumped_pem2, cleartextPrivateKeyPEM) | 964 | self.assertEqual(dumped_pem2, cleartextPrivateKeyPEM) |
| 606 | 848 | dumped_text = dump_privatekey(FILETYPE_TEXT, key) | 965 | dumped_text = dump_privatekey(FILETYPE_TEXT, key) |
| 608 | 849 | good_text = self._runopenssl(dumped_pem, "rsa", "-noout", "-text") | 966 | good_text = _runopenssl(dumped_pem, "rsa", "-noout", "-text") |
| 609 | 850 | self.assertEqual(dumped_text, good_text) | 967 | self.assertEqual(dumped_text, good_text) |
| 610 | 851 | 968 | ||
| 611 | 852 | 969 | ||
| 612 | @@ -858,13 +975,13 @@ | |||
| 613 | 858 | dumped_pem = dump_certificate_request(FILETYPE_PEM, req) | 975 | dumped_pem = dump_certificate_request(FILETYPE_PEM, req) |
| 614 | 859 | self.assertEqual(dumped_pem, cleartextCertificateRequestPEM) | 976 | self.assertEqual(dumped_pem, cleartextCertificateRequestPEM) |
| 615 | 860 | dumped_der = dump_certificate_request(FILETYPE_ASN1, req) | 977 | dumped_der = dump_certificate_request(FILETYPE_ASN1, req) |
| 617 | 861 | good_der = self._runopenssl(dumped_pem, "req", "-outform", "DER") | 978 | good_der = _runopenssl(dumped_pem, "req", "-outform", "DER") |
| 618 | 862 | self.assertEqual(dumped_der, good_der) | 979 | self.assertEqual(dumped_der, good_der) |
| 619 | 863 | req2 = load_certificate_request(FILETYPE_ASN1, dumped_der) | 980 | req2 = load_certificate_request(FILETYPE_ASN1, dumped_der) |
| 620 | 864 | dumped_pem2 = dump_certificate_request(FILETYPE_PEM, req2) | 981 | dumped_pem2 = dump_certificate_request(FILETYPE_PEM, req2) |
| 621 | 865 | self.assertEqual(dumped_pem2, cleartextCertificateRequestPEM) | 982 | self.assertEqual(dumped_pem2, cleartextCertificateRequestPEM) |
| 622 | 866 | dumped_text = dump_certificate_request(FILETYPE_TEXT, req) | 983 | dumped_text = dump_certificate_request(FILETYPE_TEXT, req) |
| 624 | 867 | good_text = self._runopenssl(dumped_pem, "req", "-noout", "-text") | 984 | good_text = _runopenssl(dumped_pem, "req", "-noout", "-text") |
| 625 | 868 | self.assertEqual(dumped_text, good_text) | 985 | self.assertEqual(dumped_text, good_text) |
| 626 | 869 | 986 | ||
| 627 | 870 | 987 | ||
It's got everything but the changelog.