Change in vdsm[master]: vdsm-reg: use M2Crypto instead of pyOpenSSL
Alon Bar-Lev
alonbl at redhat.com
Fri Oct 12 22:12:29 UTC 2012
Alon Bar-Lev has uploaded a new change for review.
Change subject: vdsm-reg: use M2Crypto instead of pyOpenSSL
......................................................................
vdsm-reg: use M2Crypto instead of pyOpenSSL
M2Crypto is much more supported and has superior coverage.
Change-Id: Id16479e61777dceffaf3c0253ef2b2954e5588a9
Signed-off-by: Alon Bar-Lev <alonbl at redhat.com>
---
M vdsm.spec.in
M vdsm_reg/deployUtil.py.in
2 files changed, 15 insertions(+), 16 deletions(-)
git pull ssh://gerrit.ovirt.org:29418/vdsm refs/changes/22/8522/1
diff --git a/vdsm.spec.in b/vdsm.spec.in
index 716489a..7c3d530 100644
--- a/vdsm.spec.in
+++ b/vdsm.spec.in
@@ -167,7 +167,7 @@
BuildArch: noarch
Requires: %{name} = %{version}-%{release}
-Requires: pyOpenSSL
+Requires: m2crypto
%description reg
VDSM registration package. Used to register a Linux host to a Virtualization
diff --git a/vdsm_reg/deployUtil.py.in b/vdsm_reg/deployUtil.py.in
index 01205df..e10fd7f 100644
--- a/vdsm_reg/deployUtil.py.in
+++ b/vdsm_reg/deployUtil.py.in
@@ -1549,10 +1549,10 @@
host -- (host, port)
"""
- # import OpenSSL here so
+ # import M2Crypto here so
# it be done only at vdsm-reg
# which depends on pyOpenSSL
- import OpenSSL
+ from M2Crypto import SSL, X509
# openssl verify callback does not
# accept context, so we collect the chain
@@ -1564,23 +1564,22 @@
# depth: certificate
chain = {}
- def verify(conn, cert, errnum, depth, ok):
- chain[depth] = OpenSSL.crypto.dump_certificate(
- OpenSSL.crypto.FILETYPE_PEM,
- cert
- ).decode("utf-8")
+ def verify(ssl_ctx_ptr, x509_ptr, errnum, errdepth, ok):
+ chain[errdepth] = X509.X509(x509=x509_ptr).as_pem()
+ return True
+ def check_ignore(*args, **kw):
return True
- ctx = OpenSSL.SSL.Context(OpenSSL.SSL.SSLv23_METHOD)
- ctx.set_verify(OpenSSL.SSL.VERIFY_PEER, verify)
- ctx.set_verify_depth(10)
- sock = OpenSSL.SSL.Connection(
- ctx,
- socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+ ctx = SSL.Context()
+ ctx.set_verify(
+ SSL.verify_peer | SSL.verify_fail_if_no_peer_cert,
+ depth=10,
+ callback=verify
)
+ sock = SSL.Connection(ctx)
+ # we would like to ignore any issue with certificates
+ sock.set_post_connection_check_callback(check_ignore)
sock.connect(host)
- sock.do_handshake()
- sock.shutdown()
sock.close()
# return sorted by depth
--
To view, visit http://gerrit.ovirt.org/8522
To unsubscribe, visit http://gerrit.ovirt.org/settings
Gerrit-MessageType: newchange
Gerrit-Change-Id: Id16479e61777dceffaf3c0253ef2b2954e5588a9
Gerrit-PatchSet: 1
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Alon Bar-Lev <alonbl at redhat.com>
More information about the vdsm-patches
mailing list