Adding CRL support
Lealem Amedie
parent
6ebc362164
commit
94f7769d6e
|
|
@ -0,0 +1,41 @@
|
|||
Certificate Revocation List (CRL):
|
||||
Version 2 (0x1)
|
||||
Signature Algorithm: sha256WithRSAEncryption
|
||||
Issuer: C = US, ST = Montana, L = Bozeman, O = Sawtooth, OU = Consulting, CN = www.wolfssl.com, emailAddress = info@wolfssl.com
|
||||
Last Update: Feb 15 12:50:27 2022 GMT
|
||||
Next Update: Nov 11 12:50:27 2024 GMT
|
||||
CRL extensions:
|
||||
X509v3 CRL Number:
|
||||
2
|
||||
Revoked Certificates:
|
||||
Serial Number: 02
|
||||
Revocation Date: Feb 15 12:50:27 2022 GMT
|
||||
Signature Algorithm: sha256WithRSAEncryption
|
||||
43:e6:3b:30:0e:32:53:32:a4:08:3c:e5:d5:2e:f1:ce:e9:95:
|
||||
ff:ba:d6:fe:2e:59:80:f8:0a:2f:cf:1e:e0:37:fe:ca:cc:33:
|
||||
66:8b:ed:65:50:7d:44:92:d3:5c:52:9a:95:a5:9d:a5:4e:77:
|
||||
8b:b4:7f:59:c8:7a:e0:eb:34:32:ae:a1:03:99:d2:3c:c0:f4:
|
||||
7e:1c:87:4c:6c:5a:ba:0a:95:e8:a1:44:01:7b:8f:3e:a4:e3:
|
||||
e8:1e:07:19:f0:09:7a:85:8f:f3:82:62:f8:1e:08:51:a3:60:
|
||||
30:5b:06:c8:a2:b3:ff:aa:28:66:ad:fe:4b:81:49:30:ef:5f:
|
||||
5d:ac:d9:ad:17:9f:2a:b6:22:d6:35:cc:9f:d9:11:26:dd:7a:
|
||||
06:35:d0:d5:c7:41:6c:52:97:8c:aa:82:5a:e5:a8:58:d4:b7:
|
||||
2b:31:84:34:15:bd:08:e4:9e:71:9e:c5:40:f8:02:a3:a0:1e:
|
||||
4f:98:72:2b:eb:9e:8a:4e:01:83:88:e5:cb:6e:3b:52:e3:a9:
|
||||
34:a1:7c:e4:79:2c:d1:e0:0b:74:22:ba:6d:cb:c3:a1:56:f9:
|
||||
c9:f4:20:bf:00:49:df:6b:59:49:18:c7:75:27:8e:a1:5a:a6:
|
||||
ff:f2:be:34:4a:c9:6d:6e:24:a3:1f:15:7e:34:90:b6:81:bf:
|
||||
15:80:c3:ac
|
||||
-----BEGIN X509 CRL-----
|
||||
MIICBDCB7QIBATANBgkqhkiG9w0BAQsFADCBlDELMAkGA1UEBhMCVVMxEDAOBgNV
|
||||
BAgMB01vbnRhbmExEDAOBgNVBAcMB0JvemVtYW4xETAPBgNVBAoMCFNhd3Rvb3Ro
|
||||
MRMwEQYDVQQLDApDb25zdWx0aW5nMRgwFgYDVQQDDA93d3cud29sZnNzbC5jb20x
|
||||
HzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5jb20XDTIyMDIxNTEyNTAyN1oX
|
||||
DTI0MTExMTEyNTAyN1owFDASAgECFw0yMjAyMTUxMjUwMjdaoA4wDDAKBgNVHRQE
|
||||
AwIBAjANBgkqhkiG9w0BAQsFAAOCAQEAQ+Y7MA4yUzKkCDzl1S7xzumV/7rW/i5Z
|
||||
gPgKL88e4Df+yswzZovtZVB9RJLTXFKalaWdpU53i7R/Wch64Os0Mq6hA5nSPMD0
|
||||
fhyHTGxaugqV6KFEAXuPPqTj6B4HGfAJeoWP84Ji+B4IUaNgMFsGyKKz/6ooZq3+
|
||||
S4FJMO9fXazZrRefKrYi1jXMn9kRJt16BjXQ1cdBbFKXjKqCWuWoWNS3KzGENBW9
|
||||
COSecZ7FQPgCo6AeT5hyK+ueik4Bg4jly247UuOpNKF85Hks0eALdCK6bcvDoVb5
|
||||
yfQgvwBJ32tZSRjHdSeOoVqm//K+NErJbW4kox8VfjSQtoG/FYDDrA==
|
||||
-----END X509 CRL-----
|
||||
|
|
@ -89,6 +89,17 @@ def build_arg_parser():
|
|||
help="Send server HTTP GET"
|
||||
)
|
||||
|
||||
parser.add_argument(
|
||||
"-C", action="store_true",
|
||||
help="Disable CRL"
|
||||
)
|
||||
|
||||
parser.add_argument(
|
||||
"-r", metavar="crl_file", default="./certs/crl.pem",
|
||||
help="CRL file, default ./certs/crl.pem"
|
||||
)
|
||||
|
||||
|
||||
return parser
|
||||
|
||||
|
||||
|
|
@ -126,7 +137,11 @@ def main():
|
|||
|
||||
try:
|
||||
secure_socket = context.wrap_socket(bind_socket)
|
||||
|
||||
|
||||
if not args.C:
|
||||
secure_socket.enable_crl(1)
|
||||
secure_socket.load_crl_file(args.r, 1);
|
||||
|
||||
secure_socket.connect((args.h, args.p))
|
||||
|
||||
if args.g:
|
||||
|
|
|
|||
|
|
@ -515,6 +515,28 @@ class SSLSocket(object):
|
|||
if ret != _SSL_SUCCESS:
|
||||
raise SSLError("Unable to set wolfSSL SNI")
|
||||
|
||||
def enable_crl(self, options):
|
||||
"""
|
||||
Enables CRL certificate revocation
|
||||
"""
|
||||
|
||||
ret = _lib.wolfSSL_EnableCRL(self.native_object, options)
|
||||
|
||||
if ret != _SSL_SUCCESS:
|
||||
raise SSLError("Unable to enable CRL ")
|
||||
|
||||
def load_crl_file(self, path, filetype):
|
||||
"""
|
||||
Load CRL certificate revocation
|
||||
"""
|
||||
|
||||
ret = _lib.wolfSSL_LoadCRLFile(self.native_object,
|
||||
t2b(path) if path else _ffi.NULL,
|
||||
filetype)
|
||||
|
||||
if ret != _SSL_SUCCESS:
|
||||
raise SSLError("Unable to load CRL")
|
||||
|
||||
def write(self, data):
|
||||
"""
|
||||
Write DATA to the underlying secure channel.
|
||||
|
|
|
|||
|
|
@ -156,6 +156,9 @@ def make_flags(prefix, debug):
|
|||
# tls 1.3
|
||||
flags.append("--enable-tls13")
|
||||
|
||||
# crl
|
||||
flags.append("--enable-crl")
|
||||
|
||||
# for urllib3 - requires SNI (tlsx), options (openssl compat), peer cert
|
||||
flags.append("--enable-tlsx")
|
||||
flags.append("--enable-opensslextra")
|
||||
|
|
@ -448,6 +451,8 @@ cdef += """
|
|||
int wolfSSL_set_tlsext_host_name(WOLFSSL*, const char*);
|
||||
long wolfSSL_ctrl(WOLFSSL*, int, long, void*);
|
||||
void wolfSSL_set_connect_state(WOLFSSL*);
|
||||
int wolfSSL_EnableCRL(WOLFSSL*, int);
|
||||
int wolfSSL_LoadCRLFile(WOLFSSL*, const char*, int);
|
||||
|
||||
/**
|
||||
* WOLFSSL_X509 functions
|
||||
|
|
|
|||
Loading…
Reference in New Issue