Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 1c03abd

Browse files
tirantiran
committed
Issue #27691: Fix ssl module's parsing of GEN_RID subject alternative name fields in X.509 certs.
1 parent 03d13c0 commit 1c03abd

5 files changed

Lines changed: 142 additions & 5 deletions

File tree

‎Lib/test/allsans.pem‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
-----BEGIN PRIVATE KEY-----
2+
MIICdgIBADANBgkqhkiG9w0BAQEFAASCAmAwggJcAgEAAoGBAOoy7/QOtTjQ0niE
3+
6uDcTwtkC0R2Tvy1AjVnXohCntZfdzbTGDoYTgXSOLsP8A697jUiJ8VCePGH50xG
4+
Z4DKnAF3a9O3a9nr2pLXb0iY3XOMv+YEBii7CfI+3oxFYgCl0sMgHzDD2ZTVYAsm
5+
DWgLUVsE2gHEccRwrM2tPf2EgR+FAgMBAAECgYEA3qyfyYVSeTrTYxO93x6ZaVMu
6+
A2IZp9zSxMQL9bKiI2GRj+cV2ebSCGbg2btFnD6qBor7FWsmYz+8g6FNN/9sY4az
7+
61rMqMtQvLBe+7L8w70FeTze4qQ4Y1oQri0qD6tBWhDVlpnbI5Py9bkZKD67yVUk
8+
elcEA/5x4PrYXkuqsAECQQD80NjT0mDvaY0JOOaQFSEpMv6QiUA8GGX8Xli7IoKb
9+
tAolPG8rQBa+qSpcWfDMTrWw/aWHuMEEQoP/bVDH9W4FAkEA7SYQbBAKnojZ5A3G
10+
kOHdV7aeivRQxQk/JN8Fb8oKB9Csvpv/BsuGxPKXHdhFa6CBTTsNRtHQw/szPo4l
11+
xMIjgQJAPoMxqibR+0EBM6+TKzteSL6oPXsCnBl4Vk/J5vPgkbmR7KUl4+7j8N8J
12+
b2554TrxKEN/w7CGYZRE6UrRd7ATNQJAWD7Yz41sli+wfPdPU2xo1BHljyl4wMk/
13+
EPZYbI/PCbdyAH/F935WyQTIjNeEhZc1Zkq6FwdOWw8ns3hrv3rKgQJAHXv1BqUa
14+
czGPIFxX2TNoqtcl6/En4vrxVB1wzsfzkkDAg98kBl7qsF+S3qujSzKikjeaVbI2
15+
/CyWR2P3yLtOmA==
16+
-----END PRIVATE KEY-----
17+
-----BEGIN CERTIFICATE-----
18+
MIIDcjCCAtugAwIBAgIJAN5dc9TOWjB7MA0GCSqGSIb3DQEBCwUAMF0xCzAJBgNV
19+
BAYTAlhZMRcwFQYDVQQHDA5DYXN0bGUgQW50aHJheDEjMCEGA1UECgwaUHl0aG9u
20+
IFNvZnR3YXJlIEZvdW5kYXRpb24xEDAOBgNVBAMMB2FsbHNhbnMwHhcNMTYwODA1
21+
MTAyMTExWhcNMjYwODAzMTAyMTExWjBdMQswCQYDVQQGEwJYWTEXMBUGA1UEBwwO
22+
Q2FzdGxlIEFudGhyYXgxIzAhBgNVBAoMGlB5dGhvbiBTb2Z0d2FyZSBGb3VuZGF0
23+
aW9uMRAwDgYDVQQDDAdhbGxzYW5zMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB
24+
gQDqMu/0DrU40NJ4hOrg3E8LZAtEdk78tQI1Z16IQp7WX3c20xg6GE4F0ji7D/AO
25+
ve41IifFQnjxh+dMRmeAypwBd2vTt2vZ69qS129ImN1zjL/mBAYouwnyPt6MRWIA
26+
pdLDIB8ww9mU1WALJg1oC1FbBNoBxHHEcKzNrT39hIEfhQIDAQABo4IBODCCATQw
27+
ggEwBgNVHREEggEnMIIBI4IHYWxsc2Fuc6AeBgMqAwSgFwwVc29tZSBvdGhlciBp
28+
ZGVudGlmaWVyoDUGBisGAQUCAqArMCmgEBsOS0VSQkVST1MuUkVBTE2hFTAToAMC
29+
AQGhDDAKGwh1c2VybmFtZYEQdXNlckBleGFtcGxlLm9yZ4IPd3d3LmV4YW1wbGUu
30+
b3JnpGcwZTELMAkGA1UEBhMCWFkxFzAVBgNVBAcMDkNhc3RsZSBBbnRocmF4MSMw
31+
IQYDVQQKDBpQeXRob24gU29mdHdhcmUgRm91bmRhdGlvbjEYMBYGA1UEAwwPZGly
32+
bmFtZSBleGFtcGxlhhdodHRwczovL3d3dy5weXRob24ub3JnL4cEfwAAAYcQAAAA
33+
AAAAAAAAAAAAAAAAAYgEKgMEBTANBgkqhkiG9w0BAQsFAAOBgQAy16h+F+nOmeiT
34+
VWR0fc8F/j6FcadbLseAUaogcC15OGxCl4UYpLV88HBkABOoGCpP155qwWTwOrdG
35+
iYPGJSusf1OnJEbvzFejZf6u078bPd9/ZL4VWLjv+FPGkjd+N+/OaqMvgj8Lu99f
36+
3Y/C4S7YbHxxwff6C6l2Xli+q6gnuQ==
37+
-----END CERTIFICATE-----

‎Lib/test/make_ssl_certs.py‎

Lines changed: 45 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,28 @@
2020
CN = {hostname}
2121
2222
[req_x509_extensions]
23-
subjectAltName = DNS:{hostname}
23+
subjectAltName = @san
24+
25+
[san]
26+
DNS.1 = {hostname}
27+
{extra_san}
28+
29+
[dir_sect]
30+
C = XY
31+
L = Castle Anthrax
32+
O = Python Software Foundation
33+
CN = dirname example
34+
35+
[princ_name]
36+
realm = EXP:0, GeneralString:KERBEROS.REALM
37+
principal_name = EXP:1, SEQUENCE:principal_seq
38+
39+
[principal_seq]
40+
name_type = EXP:0, INTEGER:1
41+
name_string = EXP:1, SEQUENCE:principals
42+
43+
[principals]
44+
princ1 = GeneralString:username
2445
2546
[ ca ]
2647
default_ca = CA_default
@@ -67,16 +88,17 @@
6788

6889
here = os.path.abspath(os.path.dirname(__file__))
6990

70-
def make_cert_key(hostname, sign=False):
91+
def make_cert_key(hostname, sign=False, extra_san=''):
7192
print("creating cert for " + hostname)
7293
tempnames = []
7394
for i in range(3):
7495
with tempfile.NamedTemporaryFile(delete=False) as f:
7596
tempnames.append(f.name)
7697
req_file, cert_file, key_file = tempnames
7798
try:
99+
req = req_template.format(hostname=hostname, extra_san=extra_san)
78100
with open(req_file, 'w') as f:
79-
f.write(req_template.format(hostname=hostname))
101+
f.write(req)
80102
args = ['req', '-new', '-days', '3650', '-nodes',
81103
'-newkey', 'rsa:1024', '-keyout', key_file,
82104
'-config', req_file]
@@ -120,7 +142,7 @@ def make_ca():
120142
f.write('unique_subject = no')
121143

122144
with tempfile.NamedTemporaryFile("w") as t:
123-
t.write(req_template.format(hostname='our-ca-server'))
145+
t.write(req_template.format(hostname='our-ca-server', extra_san=''))
124146
t.flush()
125147
with tempfile.NamedTemporaryFile() as f:
126148
args = ['req', '-new', '-days', '3650', '-extensions', 'v3_ca', '-nodes',
@@ -171,6 +193,25 @@ def make_ca():
171193
f.write(key)
172194
f.write(cert)
173195

196+
extra_san = [
197+
'otherName.1 = 1.2.3.4;UTF8:some other identifier',
198+
'otherName.2 = 1.3.6.1.5.2.2;SEQUENCE:princ_name',
199+
'email.1 = [email protected]',
200+
'DNS.2 = www.example.org',
201+
# GEN_X400
202+
'dirName.1 = dir_sect',
203+
# GEN_EDIPARTY
204+
'URI.1 = https://www.python.org/',
205+
'IP.1 = 127.0.0.1',
206+
'IP.2 = ::1',
207+
'RID.1 = 1.2.3.4.5',
208+
]
209+
210+
cert, key = make_cert_key('allsans', extra_san='\n'.join(extra_san))
211+
with open('allsans.pem', 'w') as f:
212+
f.write(key)
213+
f.write(cert)
214+
174215
unmake_ca()
175216
print("\n\nPlease change the values in test_ssl.py, test_parse_cert function related to notAfter,notBefore and serialNumber")
176217
check_call(['openssl','x509','-in','keycert.pem','-dates','-serial','-noout'])

‎Lib/test/test_ssl.py‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,8 @@ def data_file(*name):
5757
SIGNED_CERTFILE = data_file("keycert3.pem")
5858
SIGNED_CERTFILE2 = data_file("keycert4.pem")
5959
SIGNING_CA = data_file("pycacert.pem")
60+
# cert with all kinds of subject alt names
61+
ALLSANFILE = data_file("allsans.pem")
6062

6163
REMOTE_HOST = "self-signed.pythontest.net"
6264
REMOTE_ROOT_CERT = data_file("selfsigned_pythontestdotnet.pem")
@@ -279,6 +281,27 @@ def test_parse_cert_CVE_2013_4238(self):
279281

280282
self.assertEqual(p['subjectAltName'], san)
281283

284+
def test_parse_all_sans(self):
285+
p = ssl._ssl._test_decode_cert(ALLSANFILE)
286+
self.assertEqual(p['subjectAltName'],
287+
(
288+
('DNS', 'allsans'),
289+
('othername', '<unsupported>'),
290+
('othername', '<unsupported>'),
291+
('email', '[email protected]'),
292+
('DNS', 'www.example.org'),
293+
('DirName',
294+
((('countryName', 'XY'),),
295+
(('localityName', 'Castle Anthrax'),),
296+
(('organizationName', 'Python Software Foundation'),),
297+
(('commonName', 'dirname example'),))),
298+
('URI', 'https://www.python.org/'),
299+
('IP Address', '127.0.0.1'),
300+
('IP Address', '0:0:0:0:0:0:0:1\n'),
301+
('Registered ID', '1.2.3.4.5')
302+
)
303+
)
304+
282305
def test_DER_to_PEM(self):
283306
with open(CAFILE_CACERT, 'r') as f:
284307
pem = f.read()

‎Misc/NEWS‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,9 @@ Core and Builtins
6060
Library
6161
-------
6262

63+
- Issue #27691: Fix ssl module's parsing of GEN_RID subject alternative name
64+
fields in X.509 certs.
65+
6366
- Issue #27850: Remove 3DES from ssl module's default cipher list to counter
6467
measure sweet32 attack (CVE-2016-2183).
6568

‎Modules/_ssl.c‎

Lines changed: 34 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1007,6 +1007,35 @@ _get_peer_alt_names (X509 *certificate) {
10071007
PyTuple_SET_ITEM(t, 1, v);
10081008
break;
10091009

1010+
case GEN_RID:
1011+
t = PyTuple_New(2);
1012+
if (t == NULL)
1013+
goto fail;
1014+
1015+
v = PyUnicode_FromString("Registered ID");
1016+
if (v == NULL) {
1017+
Py_DECREF(t);
1018+
goto fail;
1019+
}
1020+
PyTuple_SET_ITEM(t, 0, v);
1021+
1022+
len = i2t_ASN1_OBJECT(buf, sizeof(buf)-1, name->d.rid);
1023+
if (len < 0) {
1024+
Py_DECREF(t);
1025+
_setSSLError(NULL, 0, __FILE__, __LINE__);
1026+
goto fail;
1027+
} else if (len >= (int)sizeof(buf)) {
1028+
v = PyUnicode_FromString("<INVALID>");
1029+
} else {
1030+
v = PyUnicode_FromStringAndSize(buf, len);
1031+
}
1032+
if (v == NULL) {
1033+
Py_DECREF(t);
1034+
goto fail;
1035+
}
1036+
PyTuple_SET_ITEM(t, 1, v);
1037+
break;
1038+
10101039
default:
10111040
/* for everything else, we use the OpenSSL print form */
10121041
switch (gntype) {
@@ -1033,8 +1062,12 @@ _get_peer_alt_names (X509 *certificate) {
10331062
goto fail;
10341063
}
10351064
vptr = strchr(buf, ':');
1036-
if (vptr == NULL)
1065+
if (vptr == NULL) {
1066+
PyErr_Format(PyExc_ValueError,
1067+
"Invalid value %.200s",
1068+
buf);
10371069
goto fail;
1070+
}
10381071
t = PyTuple_New(2);
10391072
if (t == NULL)
10401073
goto fail;

0 commit comments

Comments
 (0)