python - 在 PyOpenSSL 中验证客户端证书

Question

我正在编写一个需要在客户端浏览器中安装证书的应用程序。我在“上下文”对象的 PyOpenSSL 文档中找到了这个，但我看不到任何关于回调应该如何验证证书的信息，只是它应该以某种方式验证。

   set_verify(mode, callback)      Set the verification flags for this Context object to mode and      specify that callback should be used for verification callbacks.      mode should be one of VERIFY_NONE and VERIFY_PEER. If      VERIFY_PEER is used, mode can be OR:ed with      VERIFY_FAIL_IF_NO_PEER_CERT and VERIFY_CLIENT_ONCE to further      control the behaviour. callback should take five arguments: A      Connection object, an X509 object, and three integer variables,      which are in turn potential error number, error depth and return      code. callback should return true if verification passes and      false otherwise.

I'm telling the Context object where my (self signed) keys are (see below) so I guess I don't understand why that's not enough for the library to check if the cert presented by the client is a valid one. What should one do in this callback function?

class SecureAJAXServer(PlainAJAXServer):
    def __init__(self, server_address, HandlerClass):
        BaseServer.__init__(self, server_address, HandlerClass)
        ctx = SSL.Context(SSL.SSLv23_METHOD)
        ctx.use_privatekey_file ('keys/server.key')
        ctx.use_certificate_file('keys/server.crt')
        ctx.set_session_id("My_experimental_AJAX_Server")
        ctx.set_verify( SSL.VERIFY_PEER | SSL.VERIFY_FAIL_IF_NO_PEER_CERT | SSL.VERIFY_CLIENT_ONCE, callback_func )
        self.socket = SSL.Connection(ctx, socket.socket(self.address_family, self.socket_type))
        self.server_bind()
        self.server_activate()

警告:在这里编码是为了好玩，绝对不是专业人士，所以如果我的问题表明我在 SSL 方面完全跛脚、天真和/或根本缺乏理解，请不要太粗鲁!

谢谢 :)

罗杰

Answer 1

在OpenSSL documentation对于set_verify()，您关心的关键是返回码:

callback should take five arguments: A Connection object, an X509 object, and three integer variables, which are in turn potential error number, error depth and return code. callback should return true if verification passes and false otherwise.

有一个完整的工作示例可以或多或少地显示您想要做什么:When are client certificates verified?

基本上你可以忽略前 4 个参数，只检查第五个参数中返回码的值，如下所示:

from OpenSSL.SSL import Context, Connection, SSLv23_METHOD
from OpenSSL.SSL import VERIFY_PEER, VERIFY_FAIL_IF_NO_PEER_CERT, VERIFY_CLIENT_ONCE

class SecureAJAXServer(BaseServer):
    def verify_callback(connection, x509, errnum, errdepth, ok):
        if not ok:
            print "Bad Certs"
        else:
            print "Certs are fine"
        return ok

    def __init__(self, server_address, HandlerClass):
        BaseServer.__init__(self, server_address, HandlerClass)
        ctx = Context(SSLv23_METHOD)
        ctx.use_privatekey_file ('keys/server.key')
        ctx.use_certificate_file('keys/server.crt')
        ctx.set_session_id("My_experimental_AJAX_Server")
        ctx.set_verify( VERIFY_PEER | VERIFY_FAIL_IF_NO_PEER_CERT | VERIFY_CLIENT_ONCE, verify_callback )
        self.socket = Connection(ctx, socket.socket(self.address_family, self.socket_type))
        self.server_bind()
        self.server_activate()

注意:我做了另一项更改，即 from OpenSSL.SSL import ... 以在我测试它时稍微简化您的代码，因此您没有 SSL。 每个导入符号前的前缀。