Ticket #605 (defect)
Opened 2 years ago
Last modified 2 years ago
SSL parsing is broken
Status: closed (fixed)
| Reported by: | Sheco | Assigned to: | fumanchu |
|---|---|---|---|
| Priority: | normal | Milestone: | 3.0 |
| Component: | CherryPy code | Keywords: | ssl |
| Cc: |
5 days ago a a new method to parse ssl certificates was introduced to the trunk of cherrypy 3.0.
It is broken, the X509Name is weird, it doesn't help when inspecting it interactively, but I searched the docs and fixed the current implementation in cherrypy, I did it so the short names are saved int the environment, since this was the way it was previously saved, I didn't want to change it.
This is the diff:
791,794d790
< # X509Name objects don't seem to have a way to get the
< # complete DN string. Use str() and slice it instead.
< dn = str(dn)[18:-2]
<
797,802c793,804
<
< for atom in dn.split("/"):
< if atom:
< key, value = atom.split("=", 1)
< wsgikey = 'SSL_SERVER_%s_DN_%s' % (prefix, key)
< self.ssl_environ[wsgikey] = value
---
>
> for short, long in {
> 'C': 'countryName',
> 'ST': 'stateOrProvinceName',
> 'L': 'localityName',
> 'O': 'organizationName',
> 'OU': 'organizationalUnitName',
> 'CN': 'commonName',
> 'emailAddress': 'emailAddress' }.iteritems():
> wsgikey = 'SSL_SERVER_%s_DN_%s' %(prefix, short)
> print short, long
> self.ssl_environ[wsgikey] = getattr(dn, long)
Attachments
Change History
11/23/06 16:18:17: Modified by Sheco
11/27/06 12:30:30: Modified by fumanchu
- attachment url_in_dn.patch added.
Patch to allow for slashes in cert DN
11/27/06 12:33:26: Modified by fumanchu
- status changed from new to assigned.
The problem is understood, but the proposed fix won't work; the SSL environ should contain all subkeys in the DN, not just a few canonical ones. The proposed fix also damages the values of SSL_SERVER_I_DN and SSL_SERVER_S_DN.
The url_in_dn patch should correct these issues.
11/27/06 13:14:32: Modified by fumanchu
- status changed from assigned to closed.
- resolution set to fixed.
Fixed in [1448].


I forgot to mention, the method in the trunk is broken because it converts the object to string and splits it. My OU has a url, so the split("/") is not a good idea.