SSLContext doesn't support loading a CRL #53059

vstinner · 2010-05-24T21:17:09Z

BPO	8813
Nosy	@pitrou, @vstinner, @larryhastings, @giampaolo, @tiran, @ned-deily, @dstufft
Files	verify_flags_crl.patch verify_flags_crl2.patch

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = 'https://github.com/tiran'
closed_at = <Date 2014-03-18.09:41:38.862>
created_at = <Date 2010-05-24.21:17:08.659>
labels = ['extension-modules', 'type-feature', 'library']
title = "SSLContext doesn't support loading a CRL"
updated_at = <Date 2014-03-18.10:05:00.667>
user = 'https://github.com/vstinner'

bugs.python.org fields:

activity = <Date 2014-03-18.10:05:00.667>
actor = 'vstinner'
assignee = 'christian.heimes'
closed = True
closed_date = <Date 2014-03-18.09:41:38.862>
closer = 'christian.heimes'
components = ['Extension Modules', 'Library (Lib)']
creation = <Date 2010-05-24.21:17:08.659>
creator = 'vstinner'
dependencies = []
files = ['32744', '32760']
hgrepos = []
issue_num = 8813
keywords = ['patch']
message_count = 27.0
messages = ['106393', '143358', '203170', '203562', '203627', '203663', '203664', '203666', '203678', '203680', '203681', '203688', '203689', '203691', '203694', '203895', '203904', '203905', '203966', '203983', '203984', '212998', '213920', '213951', '213952', '213953', '213954']
nosy_count = 9.0
nosy_names = ['pitrou', 'vstinner', 'larry', 'giampaolo.rodola', 'christian.heimes', 'ned.deily', 'dandrzejewski', 'python-dev', 'dstufft']
pr_nums = []
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'enhancement'
url = 'https://bugs.python.org/issue8813'
versions = ['Python 3.4']

vstinner · 2010-05-24T21:17:08Z

SSL Context should support loading a CRL. See M2Crypto patches:
https://bugzilla.osafoundation.org/show_bug.cgi?id=12954
https://bugzilla.osafoundation.org/show_bug.cgi?id=11694

Or PyOpenSSL branch supporting CRL:
https://launchpad.net/~rick-fdd/pyopenssl/crl_and_revoked

pitrou · 2011-09-01T21:41:22Z

Is it enough to just load a CRL file, or is other functionality usually needed?

The following APIs should help us do it:

X509_STORE *SSL_CTX_get_cert_store(const SSL_CTX *ctx);
int X509_STORE_add_crl(X509_STORE *ctx, X509_CRL *x);
X509_CRL *d2i_X509_CRL_fp(FILE *fp,X509_CRL **crl);

And also for configuration (enable CRL checking on the context):

X509_VERIFY_PARAM *X509_STORE_CTX_get0_param(X509_STORE_CTX *ctx);
int X509_VERIFY_PARAM_set_flags(X509_VERIFY_PARAM *param, unsigned long flags);

tiran · 2013-11-17T14:24:45Z

Yes, you are right. OpenSSL uses the same API to load certs and CRLs. CRL checks must be enabled, though.

tiran · 2013-11-21T02:30:21Z

The patch implements SSLContext.verify_flags in order to enable CRL checks. It comes with documentation, a unit test and a new CRL file.

tiran · 2013-11-21T12:58:05Z

My patch is inspired by mod_ssl:

http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ssl/ssl_engine_init.c?view=markup#l697

CRLs can already be loaded with SSLContext.load_verify_locations(). The patch exposes the verification flags of SSLContext's X509_STORE. With X509_V_FLAG_CRL_CHECK OpenSSL requires (!) a CRL that matches the issuer of leaf certificate of the chain (the peer's cert). X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL also requires CRLs for all intermediate certs of the peer's cert chain.

tiran · 2013-11-21T18:12:40Z

The new patch addresses your review. I have altered the new to FLAGS_NONE, FLAGS_CLR_CHECK_LEAF etc.

pitrou · 2013-11-21T18:22:21Z

That sounds too generic. How about VERIFY_CRL_NONE, etc.

tiran · 2013-11-21T19:10:52Z

It *is* generic. The flags are not about CRL alone, http://www.openssl.org/docs/crypto/X509_VERIFY_PARAM_set_flags.html#VERIFICATION_FLAGS

pitrou · 2013-11-21T21:59:01Z

It *is* generic. The flags are not about CRL alone,

That's why I proposed VERIFY_xxx, e.g. VERIFY_CRL_NONE.

Calling some flags "FLAGS" is senseless, it's like calling an integer
"INTEGER".

tiran · 2013-11-21T22:03:27Z

s/FLAGS_/VERIFY_/g ? OK, I don't have hard feelings. :)

pitrou · 2013-11-21T22:05:32Z

s/FLAGS_/VERIFY_/g ? OK, I don't have hard feelings. :)

And VERIFY_NONE should be VERIFY_CRL_NONE IMO.

tiran · 2013-11-21T22:45:17Z

But it's not about CRL alone. How about VERIFY_DEFAULT = 0 ?

pitrou · 2013-11-21T22:47:18Z

But it's not about CRL alone. How about VERIFY_DEFAULT = 0 ?

Sounds good.

python-dev · 2013-11-21T22:56:23Z

New changeset 83805c9d1f05 by Christian Heimes in branch 'default':
Issue bpo-8813: Add SSLContext.verify_flags to change the verification flags
http://hg.python.org/cpython/rev/83805c9d1f05

tiran · 2013-11-21T23:00:45Z

memo to me: add whatsnew entry

ned-deily · 2013-11-22T21:49:09Z

This change seems to have broken the OS X 10.4 Tiger buildbot:

_ssl.c:2240: error: 'struct x509_store_st' has no member named 'param'
_ssl.c:2253: error: 'struct x509_store_st' has no member named 'param'
_ssl.c:2257: error: 'struct x509_store_st' has no member named 'param'
_ssl.c:2263: error: 'struct x509_store_st' has no member named 'param'

http://buildbot.python.org/all/builders/x86%20Tiger%203.x/builds/7370

tiran · 2013-11-22T22:21:55Z

:(

I seriously need access to a Darwin or OSX box. This is the second time I broke the build on OSX.

Ned Deily <report@bugs.python.org> schrieb:

Ned Deily added the comment:

This change seems to have broken the OS X 10.4 Tiger buildbot:

_ssl.c:2240: error: 'struct x509_store_st' has no member named 'param'
_ssl.c:2253: error: 'struct x509_store_st' has no member named 'param'
_ssl.c:2257: error: 'struct x509_store_st' has no member named 'param'
_ssl.c:2263: error: 'struct x509_store_st' has no member named 'param'

http://buildbot.python.org/all/builders/x86%20Tiger%203.x/builds/7370

----------
nosy: +ned.deily
resolution: fixed ->
status: pending -> open

Python tracker <report@bugs.python.org>
<http://bugs.python.org/issue8813\>

ned-deily · 2013-11-22T22:30:40Z

10.4 is *very* old:

$ /usr/bin/openssl version
OpenSSL 0.9.7l 28 Sep 2006

If you kept around that version of the headers and libs, you'd probably catch most of the problems.

ned-deily · 2013-11-23T05:03:20Z

This problem also breaks the 32-bit OS X installer build.

python-dev · 2013-11-23T10:24:42Z

New changeset 40d4be2b7258 by Christian Heimes in branch 'default':
Issue bpo-8813: X509_VERIFY_PARAM is only available on OpenSSL 0.9.8+
http://hg.python.org/cpython/rev/40d4be2b7258

tiran · 2013-11-23T10:40:56Z

The _ssl module compiles again with OpenSSL 0.9.7.

python-dev · 2014-03-09T22:50:26Z

New changeset 1508c4c9e747 by R David Murray in branch 'default':
whatsnew: SSLContext.verify_flags and constants. (bpo-8813)
http://hg.python.org/cpython/rev/1508c4c9e747

vstinner · 2014-03-17T23:41:04Z

What is the status of this issue? Is it fixed or not?

The What's New in Python 3.4 document says that Python 3.4 can load CRL.

tiran · 2014-03-18T09:41:39Z

Yes, Python 3.4 can load and use CRLs.

vstinner · 2014-03-18T09:44:37Z

Yes, Python 3.4 can load and use CRLs.

Great work Christian, I was expecting this feature since many years :-)

tiran · 2014-03-18T09:47:14Z

It was *really* trivial. I just had to expose two simple OpenSSL APIs to enable / disable CRL. All versions of Python could already load the CRLs but CRL checks could not be enabled.

vstinner · 2014-03-18T10:05:01Z

It was *really* trivial. I just had to expose two simple OpenSSL APIs to enable / disable CRL.

It was trivial thanks to all the work done before around SSLContext. For example, Python 2.7 doesn't have SSLContext, so adding support for CRL in Python 2.7 is non-trivial :-/

vstinner added the stdlib Python modules in the Lib dir label May 24, 2010

pitrou added the type-feature A feature request or enhancement label May 24, 2010

tiran added the extension-modules C modules in the Modules dir label Jul 8, 2013

tiran self-assigned this Nov 21, 2013

ned-deily added the release-blocker label Nov 23, 2013

tiran removed the release-blocker label Nov 23, 2013

tiran closed this as completed Mar 18, 2014

ezio-melotti transferred this issue from another repository Apr 10, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

SSLContext doesn't support loading a CRL #53059

SSLContext doesn't support loading a CRL #53059

vstinner commented May 24, 2010

vstinner commented May 24, 2010

pitrou commented Sep 1, 2011

tiran commented Nov 17, 2013

tiran commented Nov 21, 2013

tiran commented Nov 21, 2013

tiran commented Nov 21, 2013

pitrou commented Nov 21, 2013

tiran commented Nov 21, 2013

pitrou commented Nov 21, 2013

tiran commented Nov 21, 2013

pitrou commented Nov 21, 2013

tiran commented Nov 21, 2013

pitrou commented Nov 21, 2013

python-dev mannequin commented Nov 21, 2013

tiran commented Nov 21, 2013

ned-deily commented Nov 22, 2013

tiran commented Nov 22, 2013

ned-deily commented Nov 22, 2013

ned-deily commented Nov 23, 2013

python-dev mannequin commented Nov 23, 2013

tiran commented Nov 23, 2013

python-dev mannequin commented Mar 9, 2014

vstinner commented Mar 17, 2014

tiran commented Mar 18, 2014

vstinner commented Mar 18, 2014

tiran commented Mar 18, 2014

vstinner commented Mar 18, 2014

SSLContext doesn't support loading a CRL #53059

SSLContext doesn't support loading a CRL #53059

Comments

vstinner commented May 24, 2010

vstinner commented May 24, 2010

pitrou commented Sep 1, 2011

tiran commented Nov 17, 2013

tiran commented Nov 21, 2013

tiran commented Nov 21, 2013

tiran commented Nov 21, 2013

pitrou commented Nov 21, 2013

tiran commented Nov 21, 2013

pitrou commented Nov 21, 2013

tiran commented Nov 21, 2013

pitrou commented Nov 21, 2013

tiran commented Nov 21, 2013

pitrou commented Nov 21, 2013

python-dev mannequin commented Nov 21, 2013

tiran commented Nov 21, 2013

ned-deily commented Nov 22, 2013

tiran commented Nov 22, 2013

ned-deily commented Nov 22, 2013

ned-deily commented Nov 23, 2013

python-dev mannequin commented Nov 23, 2013

tiran commented Nov 23, 2013

python-dev mannequin commented Mar 9, 2014

vstinner commented Mar 17, 2014

tiran commented Mar 18, 2014

vstinner commented Mar 18, 2014

tiran commented Mar 18, 2014

vstinner commented Mar 18, 2014