Context Navigation

← Previous Change
Next Change →

python

Timestamp:

12/12/08 10:36:33 (12 years ago)

Author:

pjkersha

Message:

#1004 Security Filter:

added unit tests for SSLClientAuthNMiddleware. The middleware must <currently> be run under mod_wsgi to enable it to pick up SSL_CLIENT_CERT from environ.
TODO: extend to enable client authN with paste running over SSL? - Unit test dir contains an e.g. paste app running over SSL using pyOpenSSL but it's not clear how to pass SSL client cert to the middleware.
TODO: current version supports a simple scheme of matching a list of URLs from config to see which ones to secure - will need to change to something more sophisticated as proposed in the NDG3 work plan,

Location:

TI12-security/trunk/python

Files:

: 14 added
: 1 edited

Legend:

: Unmodified
: Added
: Removed

TI12-security/trunk/python/ndg.security.server/ndg/security/server/wsgi/sslclientauthn.py

-                      r4606
+                      r4609
 import logging
 log = logging.getLogger(__name__)
+import os
 import httplib
 from ndg.security.common.X509 import X509Cert, X509CertError
+from ndg.security.common.X509 import X509Stack, X509Cert, X509CertError
 class SSLClientAuthNMiddleware(object):
 …
+    }
     _isSSLClientCertSet = lambda self: \
         SSLClientAuthNMiddleware.sslClientCertKeyName in self._environ
+    _isSSLClientCertSet = lambda self: bool(self._environ.get(
+                                SSLClientAuthNMiddleware.sslClientCertKeyName))
     isSSLClientCertSet = property(fget=_isSSLClientCertSet,
                                   doc="Check for client cert. set in environ")
 …
         opt = SSLClientAuthNMiddleware.propertyDefaults.copy()
+        if app_conf is not None:
+            # Update from application config dictionary - filter from using
+            # prefix
+        # If no prefix is set, there is no way to distinguish options set for
+        # this app and those applying to other applications
+        if app_conf is not None and prefix:
+            # Update from application config dictionary - filter using prefix
             SSLClientAuthNMiddleware._filterOpts(opt, app_conf, prefix=prefix)
         # Similarly, filter keyword input
         SSLClientAuthNMiddleware._filterOpts(opt, kw, prefix=prefix)
+        SSLClientAuthNMiddleware._filterOpts(opt, local_conf, prefix=prefix)
         # Update options from keywords - matching app_conf ones will be
 …
         for caCertFilePath in caCertFilePathList:
+            self._caCertStack.push(X509.load_cert(caCertFilePath))
+            x509Cert = X509Cert.Read(os.path.expandvars(caCertFilePath))
+            self._caCertStack.push(x509Cert)
     caCertFilePathList = property(fset=_setCACertsFromFileList,
 …
                                       "peer certificate must validate against "
                                       "one")
+    def _getPathMatchList(self):
+        return self._pathMatchList
     def _setPathMatchList(self, pathList):
+        '''Read CA certificates from file and add them to an X.509 Cert.
+        stack
+        '''
         @type pathList: list or tuple
         @param pathList: list of URL paths to apply SSL client authentication
 …
         if isinstance(pathList, basestring):
             # Try parsing a space separated list of file paths
             pathList = pathList.split()
+             self._pathMatchList = pathList.split()
         elif not isinstance(pathList, (list, tuple)):
             raise TypeError('Expecting a list or tuple for "pathMatchList"')
+        else:
+            self._pathMatchList = pathList
+    pathMatchList = property(fget=_getPathMatchList,
+                             fset=_setPathMatchList,
+                             doc='List of URL paths to which to apply SSL '
+                                 'client authentication')
     @classmethod
 …
     def __call__(self, environ, start_response):
+        self._path = environ.get('PATH_INFO').rstrip('/')
+        self._path = environ.get('PATH_INFO')
+        if self._path != '/':
+            self._path.rstrip('/')
+        self._environ = environ
         if not self.pathMatch:
+            return self._setResponse()
+        self._environ = environ
+        if not self.sslClientCertSet:
+            return self._setErrorResponse()
+        if self.isValidClientCert():
+            return self._setResponse()
+        else:
+            return self._setErrorResponse()
+    def _setResponse(self):
+            log.debug("ignoring path [%s]" % self._path)
+            return self._setResponse(environ, start_response)
+        if not self.isSSLClientCertSet:
+            log.error("No SSL Client path set for request to [%s]"%self._path)
+            return self._setErrorResponse(environ, start_response,
+                                          msg='No client SSL Certificate set')
+        if self.isValidClientCert(environ):
+            return self._setResponse(environ, start_response)
+        else:
+            return self._setErrorResponse(environ, start_response)
+    def _setResponse(self, environ, start_response):
         if self._app:
             return self._app(environ, start_response)
 …
             return response
+    def _setErrorResponse(self, msg='Invalid SSL client certificate'):
+    def _setErrorResponse(self, environ, start_response,
+                          msg='Invalid SSL client certificate'):
         response = msg
         status = '%d %s' % (self.errorResponseCode,
 …
         return response
+    def isValidClientCert(self):
+        x509Cert = X509Cert.Parse(filePath)
+    def isValidClientCert(self, environ):
+        sslClientCert = environ[SSLClientAuthNMiddleware.sslClientCertKeyName]
+        x509Cert = X509Cert.Parse(sslClientCert)
         if len(self._caCertStack) == 0:

Note: See TracChangeset for help on using the changeset viewer.

Context Navigation

Changeset 4609 for TI12-security/trunk/python

Legend:

TI12-security/trunk/python/ndg.security.server/ndg/security/server/wsgi/sslclientauthn.py

Download in other formats: