Enable use of CRL (and more) in verify context

[sholsapp]

This change adds a number of features to the X509Store class in order to
allow use of certificate revocation lists (and more) in verification
contexts.

Fixes #256

[sholsapp]

Hey all, I submitted the PR mostly to get the testing/coverage goodness and to give others a chance to submit feedback before I spend too much longer on this. I'll ad some comments to parts I specifically have questions about.

[sholsapp]

Not all of the flags below are tested. What do folks prefer I do here: 1) expose all of the flags below and let people use them even though they're not tested or 2) only expose the flags that have been specifically tested?

[sholsapp]

Also, it appears that I need the latest version of cryptography for this PR to work. How can I do that?

[reaperhulk]

@sholsapp The Travis CI builds run against cryptography master in the allowed failures section. They abruptly error, which is usually a sign of a memory management problem: https://travis-ci.org/pyca/pyopenssl/jobs/67910194

[sholsapp]

@reaperhulk That's what I thought re: the building against master. I'll find some time to see if I can hunt down a memory error. Thanks for the tip.

[sholsapp]

I deleted my last comment couple comments and I think this patch is a red herring.

I'm finding that building and testing pyOpenSSL against head of cryptography, even without this patch, is failing at the same location. I narrowed it down to failing on OpenSSL/test/test_ssl.py:361 when instantiating Context(method).

Can someone else reproduce?

[reaperhulk]

@sholsapp Yes I can reproduce. Will have to investigate what's going on tomorrow though.

[sholsapp]

Thanks @reaperhulk. If I find anything I'll speak up.

[reaperhulk]

@sholsapp calling SSLv2_method is causing an immediate segfault in master. This does not happen in 0.9.1. Not sure why right now.

[schlenk]

typo in 'associate'

[sholsapp]

Thanks, will fix.

[reaperhulk]

As an update, this segfault is a bug in cryptography master related to conditional names not being stripped. See: pyca/cryptography#2061

[sholsapp]

Thanks for tracking that down @reaperhulk! 😄

[reaperhulk]

pyca/cryptography#2061 has been fixed. I restarted your builds and it passes on py26 and py27 but there are some issue with the PR on py3.

[sholsapp]

Thanks @reaperhulk I'll check it out soon.

[codecov-io]

Current coverage is 92.46%

Merging #281 into master will decrease coverage by -0.10% as of 23d58e8

@@            master    #281   diff @@
======================================
  Files           14      14       
  Stmts         5365    5452    +87
  Branches       486     493     +7
  Methods          0       0       
======================================
+ Hit           4966    5041    +75
- Partial        157     163     +6
- Missed         242     248     +6

Review entire Coverage Diff as of 23d58e8

Powered by Codecov. Updated on successful CI builds.

[hynek]

FYI, we usually don’t look at PRs unless codecov/commit is 100% (and not 86.36%). IOW the checks must be all green.

[sholsapp]

@hynek sure thing, that's great that we're at 100% code coverage. I'll get to this soonish.

[hynek]

JFTR, we're not at 100% project-wide; but we require new patches to be fully covered so we catch up one day. :)

[dsully]

@sholsapp - can you rebase this, and let's see where the code coverage is at? Likely only minor changes needed.

[hynek]

Please also do #478 on it. That should pretty much solve all coverage problems.

[dsully]

I have a working patch based on @sholsapp's change, rebased to HEAD & using _openssl_assert().

What's the best way to get that change into this PR? Or do I need a new PR by it's nature?

[alex]

New PR is probably the easiest approach.

On Fri, Jun 3, 2016 at 8:48 PM, Dan Sully [email protected] wrote:

I have a working patch based on @sholsapp https://github.com/sholsapp's
change, rebased to HEAD & using _openssl_assert().

What's the best way to get that change into this PR? Or do I need a new PR
by it's nature?

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
#281 (comment), or mute
the thread
https://github.com/notifications/unsubscribe/AAADBFEvyVy7Kl10XVrLb0E8uectnwstks5qIMtvgaJpZM4FJU_P
.

"I disapprove of what you say, but I will defend to the death your right to
say it." -- Evelyn Beatrice Hall (summarizing Voltaire)
"The people's good is the highest law." -- Cicero
GPG Key fingerprint: D1B3 ADC0 E023 8CA6

[dsully]

Ok, #483 is good to go, passed Travis.