Changeset 6052 for TI12-security/trunk/python/ndg_security_common/ndg/security/common/utils/m2crypto.py

Timestamp:

26/11/09 12:01:22 (10 years ago)

Author:

pjkersha

Message:

Updated MyProxy? Cert extension app for use with improved SAML Attribute Query interface class AttributeQuerySslSOAPBinding

File:

• TI12-security/trunk/python/ndg_security_common/ndg/security/common/utils/m2crypto.py (modified) (1 diff)

TI12-security/trunk/python/ndg_security_common/ndg/security/common/utils/m2crypto.py

@@ -272 +272 @@
         self.__sslValidDNs = []
 
-    def createCtx(self, **kw):
+    def createCtx(self, depth=9, **kw):
         """Create an M2Crypto SSL Context from this objects properties
+        @type depth: int
+        @param depth: max. depth of certificate to verify against
+        @type kw: dict
+        @param kw: M2Crypto.SSL.Context keyword arguments
         @rtype: M2Crypto.SSL.Context
         @return M2Crypto SSL context object
         """
         ctx = SSL.Context(**kw)
+        
+        # Configure context according to this proxy's attributes
         if self.sslCertFilePath and self.sslPriKeyFilePath:
+            # Pass client certificate
             ctx.load_cert(self.sslCertFilePath, 
                           self.__sslPriKeyFilePath, 
                           lambda *arg, **kw: self.sslPriKeyPwd)
-        
+            log.debug("Set client certificate and key in SSL Context")
+        else:
+            log.debug("No client certificate or key set in SSL Context")
+            
         if self.sslCACertFilePath or self.sslCACertDir:
+            # Set CA certificates in order to verify peer
             ctx.load_verify_locations(self.sslCACertFilePath, 
                                       self.sslCACertDir)
-            
-        ctx.set_verify(SSL.verify_peer|SSL.verify_fail_if_no_peer_cert, 9,
-                       callback=self.createVerifySSLPeerCertCallback())
+            mode = SSL.verify_peer|SSL.verify_fail_if_no_peer_cert
+        else:
+            mode = SSL.verify_fail_if_no_peer_cert
+            log.warning('No CA certificate files set: mode set to '
+                        '"verify_fail_if_no_peer_cert" only')
+            
+        if len(self.sslValidDNs) > 0:
+            # Set custom callback in order to verify peer certificate DN 
+            # against whitelist
+            callback = self.createVerifySSLPeerCertCallback()
+            log.debug('Set peer certificate Distinguished Name check set in '
+                      'SSL Context')
+        else:
+            callback = None
+            log.warning('No peer certificate Distinguished Name check set in '
+                        'SSL Context')
+            
+        ctx.set_verify(mode, depth, callback=callback)
            
         return ctx