Bill Janssen added the comment:
Yes, I think that's reasonable. And for pseudo-standards like https, which
calls for this, the implementation in the standard library should attempt to
do it automatically. Unfortunately, that means that client-side certificate
verification has to be done (it's pointless to look at the data in
unverified certificates), and that means that the client software has to
have an appropriate collection of root certificates to verify against. I
think there's an argument for adding a registry of root certificates to the
SSL module, just a module-level variable that the application can bind to a
filename of a file containing their collection of certificates. If it's
non-None, the https code would use it to verify the certificate, then use
the commonName in the subject field to check against the hostname in the
URL. If it's None, the check would be skipped.
Bill
On Dec 12, 2007 4:48 AM, Andreas Hasenack <[EMAIL PROTECTED]> wrote:
>
> Andreas Hasenack added the comment:
>
> At the least it should be made clear in the documentation that the
> hostname is not checked against the commonName nor the subjectAltName
> fields of the server certificate. And add some sample code to the
> documentation for doing a simple check. Something like this, to
> illustrate:
>
> def get_subjectAltName(cert):
> if not cert.has_key('subjectAltName'):
> return []
> ret = []
> for rdn in cert['subjectAltName']:
> if rdn[0].lower() == 'dns' or rdn[0][:2].lower() == 'ip':
> ret.append(rdn[1])
> return ret
>
> def get_commonName(cert):
> if not cert.has_key('subject'):
> return []
> ret = []
> for rdn in cert['subject']:
> if rdn[0][0].lower() == 'commonname':
> ret.append(rdn[0][1])
> return ret
>
>
> def verify_hostname(cert, host):
> cn = get_commonName(cert)
> san = get_subjectAltName(cert)
> return (host in cn) or (host in san)
>
> __________________________________
> Tracker <[EMAIL PROTECTED]>
> <http://bugs.python.org/issue1589>
> __________________________________
>
Added file: http://bugs.python.org/file8933/unnamed
__________________________________
Tracker <[EMAIL PROTECTED]>
<http://bugs.python.org/issue1589>
__________________________________Yes, I think that's reasonable. And for pseudo-standards like https,
which calls for this, the implementation in the standard library should attempt
to do it automatically. Unfortunately, that means that client-side
certificate verification has to be done (it's pointless to look at the data
in unverified certificates), and that means that the client software has to
have an appropriate collection of root certificates to verify against. I
think there's an argument for adding a registry of root certificates to the
SSL module, just a module-level variable that the application can bind to a
filename of a file containing their collection of certificates. If
it's non-None, the https code would use it to verify the certificate, then
use the commonName in the subject field to check against the hostname in the
URL. If it's None, the check would be skipped.
<br><br>Bill<br><br><div class="gmail_quote">On Dec 12, 2007 4:48 AM, Andreas
Hasenack <<a href="mailto:[EMAIL PROTECTED]">[EMAIL PROTECTED]</a>>
wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid
rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<br>Andreas Hasenack added the comment:<br><br>At the least it should be made
clear in the documentation that the<br>hostname is not checked against the
commonName nor the subjectAltName<br>fields of the server certificate. And add
some sample code to the
<br>documentation for doing a simple check. Something like this, to
illustrate:<br><br>def get_subjectAltName(cert):<br>
if not cert.has_key('subjectAltName'):<br>
return []<br> ret
= []
<br> for rdn in cert['subjectAltName']:<br>
if rdn[0].lower() ==
'dns' or rdn[0][:2].lower() == 'ip':<br>
ret.append(rdn[1])<br> return ret<br><br>
def get_commonName(cert):<br> if not
cert.has_key('subject'):<br>
return []<br> ret = []<br>
for rdn in cert['subject']:<br>
if rdn[0][0].lower() ==
'commonname':
<br>
ret.append(rdn[0][1])<br> return
ret<br><br><br>def verify_hostname(cert, host):<br>
cn = get_commonName(cert)<br> san =
get_subjectAltName(cert)<br> return (host in cn) or
(host in san)
<br><br>__________________________________<br>Tracker <<a
href="mailto:[EMAIL PROTECTED]">[EMAIL PROTECTED]</a>><br><<a
href="http://bugs.python.org/issue1589";
target="_blank">http://bugs.python.org/issue1589
</a>><br>__________________________________<br></blockquote></div><br>
_______________________________________________
Python-bugs-list mailing list
Unsubscribe:
http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
