Changeset cedf721

Timestamp:

Jul 8, 2011 6:30:09 PM (13 years ago)

Author:

Ted Faber <faber@…>

Branches:

axis_example, compt_changes, info-ops, master

Children:

b3c4896

Parents:

2396f591

Message:

Cleaner handling of self-signed certs (new errcode)

File:

• fedd/federation/util.py (modified) (5 diffs)

fedd/federation/util.py

@@ -19 +19 @@
 from service_error import service_error
 from urlparse import urlparse
+from M2Crypto import m2
 
 
@@ -27 +28 @@
 if not getattr(SSL.cb, 'ssl_verify_callback_allow_unknown_ca', None):
     from M2Crypto.SSL.Context import map
-    from M2Crypto import m2
-
-    def ssl_verify_callback(ssl_ctx_ptr, x509_ptr, errnum, errdepth, ok):
+
+    def fedd_ssl_verify_callback(ssl_ctx_ptr, x509_ptr, errnum, errdepth, ok):
         unknown_issuer = [
             m2.X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY,
@@ -36 +36 @@
             m2.X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT
             ]
+        # m2.X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN should also be allowed
+        if getattr(m2, 'X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN', None):
+            unknown_issuer.append(getattr(m2, 
+                'X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN', None))
         ssl_ctx = map()[ssl_ctx_ptr]
 
@@ -49 +53 @@
         return ok
 else:
-    def ssl_verify_callback(ssl_ctx_ptr, x509_ptr, errnum, errdepth, ok):
-        raise ValueError("This should never be called")
+    def fedd_ssl_verify_callback(ok, store):
+        '''
+        m2.X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN should also be allowed
+        '''
+        errnum = store.get_error()
+        if errnum == m2.X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN:
+            ok = 1
+            return ok
+        else:
+            return SSL.cb.ssl_verify_callback_allow_unknown_ca(ok, store)
 
 class fedd_ssl_context(SSL.Context):
@@ -89 +101 @@
             self.set_verify(SSL.verify_peer, 10)
         else:
-            # More legacy code.  Recent versions of M2Crypto express the
-            # allow_unknown_ca option through a callback turned to allow it.
-            # Older versions use a standard callback that respects the
-            # attribute.  This should work under both regines.
-            callb = getattr(SSL.cb, 'ssl_verify_callback_allow_unknown_ca', 
-                    ssl_verify_callback)
+            # Install the proper callback to allow self-signed certs
             self.set_allow_unknown_ca(True)
-            self.set_verify(SSL.verify_peer, 10, callback=callb)
+            self.set_verify(SSL.verify_peer, 10, 
+                    callback=fedd_ssl_verify_callback)
 
 class file_expanding_opts(OptionParser):