[Patches] [ python-Patches-461337 ] Docs for SSL methods and objects

[noreply@sourceforge.net]

Patches item #461337, was opened at 2001-09-13 13:33
You can respond by visiting: 
http://sourceforge.net/tracker/?func=detail&atid=305470&aid=461337&group_id=5470

Category: Documentation
Group: None
Status: Open
Resolution: None
Priority: 5
Submitted By: Gerhard Häring (ghaering)
Assigned to: Fred L. Drake, Jr. (fdrake)
Summary: Docs for SSL methods and objects

Initial Comment:
This is my try to fix bug #215026. Perhaps a link to
the OpenSSL homepage should be added somewhere (so we
don't have to explain all that private key and
certificate stuff in the docs ourselves).

I also think it should be indicated somewhere, that
Python's SSL implementation is incomplete, not to be
considered secure (certificates aren't checked) and
thus (at least I hope so :-), likely to be changed in
the future.
Did I already say that the SSL stuff looks quite broken?

----------------------------------------------------------------------

>Comment By: Gerhard Häring (ghaering)
Date: 2001-09-13 14:17

Message:
Logged In: YES 
user_id=163326

Well, I don't fully understand the code either (and just
know the basics about sockets and OpenSSL).

With incomplete, I mean that it would be nice if the
SSLObject were compatible to a socket object and thus
interchangeable. This is currently not the case. Sockets
have send() and recv() while the SSLObject has read() and
write(). Another possibility would be to make the SSLObject
a "file-like object".

As for why I think it's broken: The ssl() method requires
that you provide it with a private key file and a certficate
key store (that contains known certifictates of Certificate
Authorities (Verisign, ...) and server certificates). But it
 looks like the code doesn't check the certificates at all,
and a forged certificate is silently ignored, even if it
could be detected. I'm mainly drawing my conclusion from
this line of code and the OpenSSL documentation for this
function (socketmodule.c; newSSLObject()):

SSL_CTX_set_verify(self->ctx,
                           SSL_VERIFY_NONE, NULL); /* set
verify lvl */


I'll try to look further into this.


----------------------------------------------------------------------

Comment By: Guido van Rossum (gvanrossum)
Date: 2001-09-13 13:39

Message:
Logged In: YES 
user_id=6380

Thanks for the feedback, Gerhard. Unfortunately this code
was donated and nobody at PythonLabs understands it enough
to fix it. Do you want to help? At least tell us what you
think "looks quite broken". If you know how to fix it, that
would be great!

----------------------------------------------------------------------

You can respond by visiting: 
http://sourceforge.net/tracker/?func=detail&atid=305470&aid=461337&group_id=5470