Add the ability to set a custom verification time on X509Store #567

tsileo · 2016-10-24T22:52:23Z

This PR add a set_time methods on OpenSSL.crypto.X509Store.

This new methods:

create a X509_VERIFY_PARAM
"set" the given time (a datetime.datetime instance)
and finally "set" the param on the X509Store

One things I'm worried about is if the X509_VERIFY_PARAM should be "gc"ed manually? or it will be cleaned when the X509Store will be "gc"ed?

I chose to implement the method on X509Store because it's more convenient to set the time only once on the store, and then verify multiple certificates (instead of having to set it in each X509StoreContext).

Thanks!

codecov-io · 2016-10-24T23:19:34Z

Current coverage is 95.65% (diff: 100%)

Merging #567 into master will increase coverage by 0.18%

@@             master       #567   diff @@
==========================================
  Files            16         16          
  Lines          5610       5614     +4   
  Methods           0          0          
  Messages          0          0          
  Branches        408        403     -5   
==========================================
+ Hits           5356       5370    +14   
+ Misses          176        167     -9   
+ Partials         78         77     -1

Powered by Codecov. Last update 67666e2...a0bdd7a

reaperhulk · 2016-11-06T04:31:09Z

src/OpenSSL/crypto.py

+        :param datetime vfy_time: The verification time to set on this store.
+        :return: ``None`` if the verification time were successfully set.
+        """
+        param = _lib.X509_VERIFY_PARAM_new()


You'll need to add a param = _ffi.gc(param, X509_VERIFY_PARAM_free) to this. X509_STORE_set1_param increfs it so without a corresponding free to decref after creation it will leak.

Thanks for your feedback!

When I try:

from OpenSSL._util import lib lib.X509_VERIFY_PARAM_free

I got this exception on my system: AttributeError: 'module' object has no attribute 'X509_VERIFY_PARAM_free'

It looks like X509_VERIFY_PARAM_free is not exported, I should do a PR on cryptography to export it? or something is wrong on my side?

Thanks!

Nope, you're quite right it isn't currently exported in cryptography. Please do submit a PR there!

tsileo · 2016-11-06T10:53:15Z

I've made the change, I'll push once the cryptography PR has been merged (to make the CI works).

reaperhulk · 2016-11-06T10:57:48Z

We won't be able to merge this until after we do a cryptography release with the new binding (and this PR will then need to be updated to reflect the new minimum version required), but now we can see if it works against cryptography master :)

reaperhulk · 2016-11-06T11:04:26Z

I am unfamiliar with the state of docs for X509Store, does this function need to be documented outside of the docstring @hynek?

reaperhulk · 2016-11-06T11:04:45Z

src/OpenSSL/crypto.py

+        .. versionadded: 16.3.0
+
+        :param datetime vfy_time: The verification time to set on this store.
+        :return: ``None`` if the verification time were successfully set.


hynek · 2016-11-06T11:25:47Z

On phone but it's gonna need an automethod line somewhere.

tsileo · 2016-11-06T11:43:24Z

@reaperhulk no problem I get it. I'll follow the "Sixteenth Release" milestone of cryptography.

Let me know what changes are needed for the doc, I checked doc/api/crypto.rst and with autoclass:: X509Store and :members: I though it would be OK with doc, unless it need to be displayed somewhere else.

tsileo · 2016-11-06T12:01:52Z

The build fails because it's using cryptography==1.5.3, it passes locally with cryptography master.

I will wait till the new cryptography version is released.

reaperhulk · 2016-11-22T03:48:33Z

@tsileo cryptography 1.6 is now out :)

tsileo · 2016-11-22T08:29:12Z

Thanks for the heads-up!

How should I update the doc to reflect the new minimum version required for cryptography? I can't find any example.

And I think it should be OK for the doc due to the autoclass::X509Store but let me know.

Any other change I need to make?

reaperhulk · 2016-11-22T10:10:29Z

Probably something like "bumped minimum cryptography version to 1.6", but hynek may have a preference. Technically this PR is fine @hynek so if you've got any stylistic nits speak now :)

hynek · 2016-11-22T10:18:44Z

Before we get into stylistic questions, the new minimum version has to be applied to setup.py/tox.ini.

tsileo · 2016-11-22T11:52:14Z

Done! Let me know if there's something else I need to do :)

hynek · 2016-11-22T11:47:55Z

tox.ini

@@ -9,7 +9,7 @@ deps =
    coverage>=4.2
    pytest>=3.0.1
    cryptographyMaster: git+https://github.com/pyca/cryptography.git
-    cryptographyMinimum: cryptography<1.4
+    cryptographyMinimum: cryptography==1.6


This got to be <1.7 so we always test against the latest 1.6 release.

hynek · 2016-11-22T11:48:12Z

src/OpenSSL/crypto.py

@@ -1518,6 +1518,20 @@ def set_flags(self, flags):
        """
        _openssl_assert(_lib.X509_STORE_set_flags(self._store, flags) != 0)

+    def set_time(self, vfy_time):
+        """Set verification time to this store.


""" on own lines please.

hynek · 2016-11-22T11:50:03Z

tests/test_crypto.py

@@ -3740,6 +3740,27 @@ def test_modification_pre_verify(self):
        store_ctx.set_store(store_good)
        self.assertEqual(store_ctx.verify_certificate(), None)

+    def test_verify_with_time(self):
+        """
+        :func:`verify_certificate` raises error when the verification time is


I know the code base is inconsistent in this regard, but please don't use type prefixes like :func: in test doc strings. They are never rendered and there’s no way to verify them at all.

hynek · 2016-11-22T11:59:19Z

As for documenting minimum cryptography version I’m not sure either. Until now, we’ve never really documented it in the CHANGELOG…

tsileo · 2016-11-22T14:30:17Z

@hynek I just pushed the style tweaks and updated the minimum cryptography requirements.

hynek · 2016-11-22T14:31:13Z

src/OpenSSL/crypto.py

@@ -1514,10 +1514,24 @@ def set_flags(self, flags):

        :param int flags: The verification flags to set on this store.
            See :class:`X509StoreFlags` for available constants.
-        :return: ``None`` if the verification flags were successfully set.


heh you removed the wrong one but I see the qualification is everywhere in this class so just re-add this one and let the other be for now

Oops, I was checking if it was present in other methods. I just re-added it.

hynek · 2016-11-22T14:54:03Z

src/OpenSSL/crypto.py

@@ -1518,6 +1518,21 @@ def set_flags(self, flags):
        """
        _openssl_assert(_lib.X509_STORE_set_flags(self._store, flags) != 0)

+    def set_time(self, vfy_time):
+        """
+        Set verification time to this store.


Final thing: could you add a few more lines about the what that method is good for? Is that grammar even correct? Honest question. :)

No problem. Not sure it was correct. It's updated.

hynek · 2016-11-22T16:32:02Z

flake8 is failing

tsileo · 2016-11-22T16:41:20Z

Sorry about that, I fixed the line too long (my config is set at 120 :p)

seems resolved

hynek · 2016-11-22T17:14:44Z

thanks!

Upstream changes: * Added OpenSSL.X509Store.set_time() to set a custom verification time when verifying certificate chains. pyca/pyopenssl#567 * Added a collection of functions for working with OCSP stapling. None of these functions make it possible to validate OCSP assertions, only to staple them into the handshake and to retrieve the stapled assertion if provided. Users will need to write their own code to handle OCSP assertions. We specifically added: Context.set_ocsp_server_callback, Context.set_ocsp_client_callback, and Connection.request_ocsp. pyca/pyopenssl#580 * Changed the SSL module's memory allocation policy to avoid zeroing memory it allocates when unnecessary. This reduces CPU usage and memory allocation time by an amount proportional to the size of the allocation. For applications that process a lot of TLS data or that use very lage allocations this can provide considerable performance improvements. pyca/pyopenssl#578 * Automatically set SSL_CTX_set_ecdh_auto() on OpenSSL.SSL.Context. pyca/pyopenssl#575 * Fix empty exceptions from OpenSSL.crypto.load_privatekey(). pyca/pyopenssl#581 The full upstream changelog can be found at: https://pyopenssl.readthedocs.io/en/17.0.0/changelog.html I've also added a patch from pyca/pyopenssl#637 in order to fix the tests, which was the main reason for the version bump because that patch won't apply for 16.2.0. According to the upstream changelog there should be no backwards-incompatible changes, but I've tested building against some of the packages depending on pyopenssl anyway. Regardless of this, the build for pyopenssl fails right now anyway, so the worst that could happen via this commit would be that we break something that's already broken. Signed-off-by: aszlig <[email protected]>

tsileo added 2 commits October 25, 2016 00:41

Add the ability to set a custom verification time on X509Store

6fd2adf

Fixed line too long

d60db38

tsileo added 4 commits October 25, 2016 01:36

Update the Changelog

2d4929b

Updated CHANGELOG

67c9bc8

Cleanup tests

90ed8cb

Fix tests

85158ff

reaperhulk previously requested changes Nov 6, 2016

View reviewed changes

tsileo mentioned this pull request Nov 6, 2016

Export missing OpenSSL X509_VERIFY_PARAM_free pyca/cryptography#3221

Merged

Add mising gc call for X509_VERIFY_PARAM

67ec91a

reaperhulk reviewed Nov 6, 2016

View reviewed changes

Fix typo in docstring

96f1394

hynek added the waiting-for-bindings label Nov 18, 2016

hynek removed the waiting-for-bindings label Nov 22, 2016

Bumped minimum cryptography version to 1.6

0f85779

hynek requested changes Nov 22, 2016

View reviewed changes

Fix cryptographyMinimum in tox.ini and tweaked docstrings

810bbe0

hynek reviewed Nov 22, 2016

View reviewed changes

Fix docstring

b0ff2ec

hynek reviewed Nov 22, 2016

View reviewed changes

Tweak the docstring

db8f831

hynek approved these changes Nov 22, 2016

View reviewed changes

Fix docstring (line too long)

a0bdd7a

hynek merged commit e15e60a into pyca:master Nov 22, 2016

hynek mentioned this pull request Dec 5, 2016

X509_STORE_CTX_set_time missing #582

Closed

ikonst mentioned this pull request Dec 6, 2016

Respect receipt time during verification SilentCircle/iap-local-receipt#2

Merged

github-actions bot locked as resolved and limited conversation to collaborators Aug 18, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add the ability to set a custom verification time on X509Store #567

Add the ability to set a custom verification time on X509Store #567

tsileo commented Oct 24, 2016

codecov-io commented Oct 24, 2016 •

edited

Loading

reaperhulk Nov 6, 2016

tsileo Nov 6, 2016

reaperhulk Nov 6, 2016

tsileo commented Nov 6, 2016

reaperhulk commented Nov 6, 2016

reaperhulk commented Nov 6, 2016

reaperhulk Nov 6, 2016

hynek commented Nov 6, 2016

tsileo commented Nov 6, 2016

tsileo commented Nov 6, 2016 •

edited

Loading

reaperhulk commented Nov 22, 2016

tsileo commented Nov 22, 2016 •

edited

Loading

reaperhulk commented Nov 22, 2016

hynek commented Nov 22, 2016

tsileo commented Nov 22, 2016

hynek Nov 22, 2016

hynek Nov 22, 2016

hynek Nov 22, 2016

hynek commented Nov 22, 2016

tsileo commented Nov 22, 2016

hynek Nov 22, 2016

tsileo Nov 22, 2016

hynek Nov 22, 2016

tsileo Nov 22, 2016

hynek commented Nov 22, 2016

tsileo commented Nov 22, 2016

hynek commented Nov 22, 2016

Add the ability to set a custom verification time on X509Store #567

Add the ability to set a custom verification time on X509Store #567

Conversation

tsileo commented Oct 24, 2016

codecov-io commented Oct 24, 2016 • edited Loading

Current coverage is 95.65% (diff: 100%)

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tsileo commented Nov 6, 2016

reaperhulk commented Nov 6, 2016

reaperhulk commented Nov 6, 2016

Choose a reason for hiding this comment

hynek commented Nov 6, 2016

tsileo commented Nov 6, 2016

tsileo commented Nov 6, 2016 • edited Loading

reaperhulk commented Nov 22, 2016

tsileo commented Nov 22, 2016 • edited Loading

reaperhulk commented Nov 22, 2016

hynek commented Nov 22, 2016

tsileo commented Nov 22, 2016

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

hynek commented Nov 22, 2016

tsileo commented Nov 22, 2016

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

hynek commented Nov 22, 2016

tsileo commented Nov 22, 2016

hynek commented Nov 22, 2016

codecov-io commented Oct 24, 2016 •

edited

Loading

tsileo commented Nov 6, 2016 •

edited

Loading

tsileo commented Nov 22, 2016 •

edited

Loading