classification
Title: Add SSL_CTX_set_client_cert_engine
Type: behavior Stage: needs patch
Components: SSL Versions: Python 3.7
process
Status: open Resolution:
Dependencies: Superseder:
Assigned To: christian.heimes Nosy List: Andrea Grandi, christian.heimes, gik
Priority: normal Keywords:

Created on 2016-11-15 11:01 by christian.heimes, last changed 2017-02-14 20:33 by gik.

Messages (7)
msg280830 - (view) Author: Christian Heimes (christian.heimes) * (Python committer) Date: 2016-11-15 11:01
Python's ssl module does not support smartcard authentication of clients.
In order to use an external engine like OpenSC's engine_pkcs11, SSLContext must be configured to use a loaded engine for client cert auth. It's really simple. Pseudo code without error reporting, engine_id is a char*:

ENGINE *e = ENGINE_by_id(engine_id);
SSL_CTX_set_client_cert_engine(ctx, e);
msg283782 - (view) Author: Gennady Kovalev (gik) Date: 2016-12-21 20:38
Why not to call OPENSSL_config() to use openssl.cnf?

--- ./Modules/_ssl.c.orig       2016-12-21 23:30:36.277184891 +0300
+++ ./Modules/_ssl.c    2016-12-21 23:35:18.488508435 +0300
@@ -4514,6 +4514,8 @@
     PySocketModule = *socket_api;
 
     /* Init OpenSSL */
+    OPENSSL_config(NULL);
+
     SSL_load_error_strings();
     SSL_library_init();
 #ifdef WITH_THREAD

(Patch for example, for 3.5.2 source, not try to compile)
msg283842 - (view) Author: Christian Heimes (christian.heimes) * (Python committer) Date: 2016-12-22 14:16
OPENSSL_config() is deprecated. I'm going to wrap CONF_modules_load_file(), CONF_modules_load() and NCONF_load_bio().
msg283903 - (view) Author: Andrea G (Andrea Grandi) Date: 2016-12-23 20:47
What about using OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CONFIG, NULL) instead of OPENSSL_config()?
msg287796 - (view) Author: Gennady Kovalev (gik) Date: 2017-02-14 20:14
Is there any news?
msg287797 - (view) Author: Christian Heimes (christian.heimes) * (Python committer) Date: 2017-02-14 20:22
I haven't started to design the new feature yet. Since it is going to be a new feature and feature freeze of 3.7 is 2018-01-29, I'm going to start working on new stuff around in April or May for PyCon.
msg287798 - (view) Author: Gennady Kovalev (gik) Date: 2017-02-14 20:33
Ok, thank you.
History
Date User Action Args
2017-02-14 20:33:36giksetmessages: + msg287798
2017-02-14 20:22:27christian.heimessetmessages: + msg287797
2017-02-14 20:14:16giksetmessages: + msg287796
2016-12-23 20:47:17Andrea Grandisetnosy: + Andrea Grandi
messages: + msg283903
2016-12-22 14:16:47christian.heimessetmessages: + msg283842
2016-12-21 20:38:14giksetnosy: + gik
messages: + msg283782
2016-11-15 11:01:35christian.heimessetversions: + Python 3.7
2016-11-15 11:01:28christian.heimescreate