python - Twisted Python、TLS 和客户端/服务器证书身份验证错误

Question

我一直在尽我所能地学习 Twisted，但加上有限的 TLS 知识，事实证明它具有挑战性。我正在尝试(最终)编写一个 SMTP 服务器，它可以根据要发送/接收的特定消息的要求，以纯文本或通过 TLS 发送和接收消息。

我的示例服务器代码(到目前为止，只是处理 TLS 连接，还没有 SMTP 位!)是从 http://twistedmatrix.com/documents/11.0.0/core/howto/ssl.html#auto5 借来的看起来像:

from OpenSSL import SSL
from twisted.internet import reactor, ssl
from twisted.internet.protocol import ServerFactory
from twisted.protocols.basic import LineReceiver

class TLSServer(LineReceiver):
    def lineReceived(self, line):
        print "received: " + line

        if line == "STARTTLS":
            print "-- Switching to TLS"
            self.sendLine('READY')
            ctx = ServerTLSContext(
                privateKeyFileName='SSCerts/serverkey.pem',
                certificateFileName='SSCerts/servercert.pem',
                )
            self.transport.startTLS(ctx, self.factory)


class ServerTLSContext(ssl.DefaultOpenSSLContextFactory):
    def __init__(self, *args, **kw):
        kw['sslmethod'] = SSL.TLSv1_METHOD
        ssl.DefaultOpenSSLContextFactory.__init__(self, *args, **kw)

if __name__ == '__main__':
    factory = ServerFactory()
    factory.protocol = TLSServer
    reactor.listenTCP(8000, factory)
    reactor.run()

而客户端是从http://twistedmatrix.com/documents/14.0.0/core/howto/ssl.html#starttls-client借来的看起来像:

from twisted.internet import ssl, endpoints, task, protocol, defer
from twisted.protocols.basic import LineReceiver
from twisted.python.modules import getModule

class StartTLSClient(LineReceiver):
    def connectionMade(self):
        self.sendLine("plain text")
        self.sendLine("STARTTLS")

    def lineReceived(self, line):
        print("received: " + line)
        if line == "READY":
            self.transport.startTLS(self.factory.options)
            self.sendLine("secure text")
            self.transport.loseConnection()

@defer.inlineCallbacks
def main(reactor):
    factory = protocol.Factory.forProtocol(StartTLSClient)
    certData = getModule(__name__).filePath.sibling('servercert.pem').getContent()
    factory.options = ssl.optionsForClientTLS(
        u"example.com", ssl.PrivateCertificate.loadPEM(certData)
    )
    endpoint = endpoints.HostnameEndpoint(reactor, 'localhost', 8000)
    startTLSClient = yield endpoint.connect(factory)

    done = defer.Deferred()
    startTLSClient.connectionLost = lambda reason: done.callback(None)
    yield done

if __name__ == "__main__":
    import starttls_client
    task.react(starttls_client.main)

但是当我让服务器监听并运行客户端时，我得到:

    /usr/lib64/python2.6/site-packages/twisted/internet/endpoints.py:30: DeprecationWarning: twisted.internet.interfaces.IStreamClientEndpointStringParser was deprecated in Twisted 14.0.0: This interface has been superseded by IStreamClientEndpointStringParserWithReactor.
  from twisted.internet.interfaces import (
main function encountered error
Traceback (most recent call last):
  File "starttls_client.py", line 33, in <module>
    task.react(starttls_client.main)
  File "/usr/lib64/python2.6/site-packages/twisted/internet/task.py", line 875, in react
    finished = main(_reactor, *argv)
  File "/usr/lib64/pytho

n2.6/site-packages/twisted/internet/defer.py", line 1237, in unwindGenerator
        return _inlineCallbacks(None, gen, Deferred())
    --- <exception caught here> ---
      File "/usr/lib64/python2.6/site-packages/twisted/internet/defer.py", line 1099, in _inlineCallbacks
        result = g.send(result)
      File "/root/Robot/Twisted/starttls_client.py", line 22, in main
        u"example.com", ssl.PrivateCertificate.loadPEM(certData)
      File "/usr/lib64/python2.6/site-packages/twisted/internet/_sslverify.py", line 619, in loadPEM
        return Class.load(data, KeyPair.load(data, crypto.FILETYPE_PEM),
      File "/usr/lib64/python2.6/site-packages/twisted/internet/_sslverify.py", line 725, in load
        return Class(crypto.load_privatekey(format, data))
      File "build/bdist.linux-x86_64/egg/OpenSSL/crypto.py", line 2010, in load_privatekey

  File "build/bdist.linux-x86_64/egg/OpenSSL/_util.py", line 22, in exception_from_error_queue

OpenSSL.crypto.Error: []

奇怪的是 - 我知道证书和 key 没问题 - 我还有其他“虚拟”代码(没有粘贴在这里，我认为这篇文章已经足够长了!!)使用它们进行验证就好了。谁能解释上面的代码在哪里失败？我不知所措......

谢谢 :)

Answer 1

因此，在以下位置找到的示例代码中似乎存在错误:http://twistedmatrix.com/documents/14.0.0/core/howto/ssl.html

查看示例“echoclient_ssl.py”，有一行:

authority = ssl.Certificate.loadPEM(certData)

但是，“starttls_client.py”示例代码中的等效代码是:

ssl.PrivateCertificate.loadPEM(certData)

客户端的 PrivateCertificate？即使我对 TLS 的了解有限，这似乎也是错误的。事实上，我修改了我的代码以删除“私有(private)”......并且上面的错误消失了!

正如我所说，我的知识和理解在这里不断增长 - 但这似乎确实是我的问题的问题/解决方案!