Changeset fe157b9

Timestamp:

Dec 22, 2008 5:58:25 PM (16 years ago)

Author:

Ted Faber <faber@…>

Branches:

axis_example, compt_changes, info-ops, master, version-1.30, version-2.00, version-3.01, version-3.02

Children:

ca24951

Parents:

b09f346

Message:

Zero-length self-signed certs failed under python 2.4/M2Crypto0.13. This explicitly fixes them

File:

• fedd/federation/util.py (modified) (2 diffs)

fedd/federation/util.py

@@ -7 +7 @@
 from M2Crypto import SSL
 from fedid import fedid
+
+
+# If this is an old enough version of M2Crypto.SSL that has an
+# ssl_verify_callback that doesn't allow 0-length signed certs, create a
+# version of that callback that does.  This is edited from the original in
+# M2Crypto.SSL.cb.  This version also elides the printing to stderr.
+if not getattr(SSL.cb, 'ssl_verify_callback_allow_unknown_ca', None):
+    from M2Crypto.SSL.Context import map
+    from M2Crypto import m2
+
+    def ssl_verify_callback(ssl_ctx_ptr, x509_ptr, errnum, errdepth, ok):
+        unknown_issuer = [
+            m2.X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY,
+            m2.X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE,
+            m2.X509_V_ERR_CERT_UNTRUSTED,
+            m2.X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT
+            ]
+        ssl_ctx = map()[ssl_ctx_ptr]
+
+        if errnum in unknown_issuer: 
+            if ssl_ctx.get_allow_unknown_ca():
+                ok = 1
+        # CRL checking goes here...
+        if ok:
+            if ssl_ctx.get_verify_depth() >= errdepth:
+                ok = 1
+            else:
+                ok = 0
+        return ok
+else:
+    def ssl_verify_callback(ssl_ctx_ptr, x509_ptr, errnum, errdepth, ok):
+        raise ValueError("This should never be called")
 
 class fedd_ssl_context(SSL.Context):
@@ -48 +80 @@
             # attribute.  This should work under both regines.
             callb = getattr(SSL.cb, 'ssl_verify_callback_allow_unknown_ca', 
-                    SSL.cb.ssl_verify_callback)
+                    ssl_verify_callback)
             self.set_allow_unknown_ca(True)
             self.set_verify(SSL.verify_peer, 10, callback=callb)