verification: client verification APIs #10345

woodruffw · 2024-02-04T13:52:21Z

~~Still WIP -- the public APIs are not fully filled in yet. Outstanding tasks:~~

Fill in build_client_verifier
Add and implement ClientVerifier.verify
Unit tests (including limbo tests?)

Closes #10276.

Signed-off-by: William Woodruff <william@yossarian.net>

src/cryptography/hazmat/bindings/_rust/x509.pyi

src/rust/cryptography-x509-verification/src/policy/mod.rs

src/rust/src/x509/verify.rs

alex · 2024-02-04T21:22:15Z

That makes sense to me

…

On Sun, Feb 4, 2024, 4:20 PM William Woodruff ***@***.***> wrote: ***@***.**** commented on this pull request. ------------------------------ In src/cryptography/hazmat/bindings/_rust/x509.pyi <#10345 (comment)>: > + ) -> tuple[ + x509.Name, x509.SubjectAlternativeName | None, list[x509.Certificate] + ]: ... Named type makes sense! Re: subject: in that case, perhaps client verification should enforce the presence of a SAN? That should be trivial to do. — Reply to this email directly, view it on GitHub <#10345 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAAGBGNRZWSBXWE4IGIEZDYR73QLAVCNFSM6AAAAABCY4GHUGVHI2DSMVQWIX3LMV43YUDVNRWFEZLROVSXG5CSMV3GSZLXHMYTQNRRGU3DCOBQGE> . You are receiving this because you commented.Message ID: ***@***.***>

Signed-off-by: William Woodruff <william@yossarian.net>

src/cryptography/x509/verification.py

src/rust/src/x509/verify.rs

Signed-off-by: William Woodruff <william@yossarian.net>

docs/x509/verification.rst

src/rust/cryptography-x509-verification/src/policy/extension.rs

src/rust/cryptography-x509-verification/src/policy/mod.rs

src/rust/src/x509/verify.rs

alex · 2024-02-10T01:44:10Z

PS: Yes, there should be limbo tests for this. In principle the schema was designed in a way to incorporate them.

Signed-off-by: William Woodruff <william@yossarian.net>

woodruffw · 2024-02-11T14:37:21Z

I'll work on the limbo tests for this shortly (✈️)

woodruffw · 2024-02-26T20:02:27Z

For tracking: C2SP/x509-limbo#196 has the initial client cases. I'm going to poke at email NC handling in a separate PR first, and then align those tests here.

woodruffw · 2024-02-28T00:35:00Z

Email NC bits are merged, so I'll take another poke at this tonight or tomorrow.

woodruffw · 2024-03-05T03:24:52Z

This will be at 100% coverage once C2SP/x509-limbo#221 lands. After that, I'll also look at filtering the set of subjects returned by the API to just ones that we currently have NC support for.

This is what we should have been doing originally, per RFC 5280 4.2.1.10: > If a name constraints extension that is marked as critical > imposes constraints on a particular name form, and an instance of > that name form appears in the subject field or subjectAltName > extension of a subsequent certificate, then the application MUST > either process the constraint or reject the certificate.

Signed-off-by: William Woodruff <william@yossarian.net>

woodruffw · 2024-03-20T17:09:02Z

This should be good for a review!

src/rust/cryptography-x509-verification/src/policy/mod.rs

tests/x509/verification/test_limbo.py

woodruffw added 2 commits February 4, 2024 14:50

verification: WIP client verification skeleton

7c42c64

Signed-off-by: William Woodruff <william@yossarian.net>

verify: fill in build_client_verifier

543f055

Signed-off-by: William Woodruff <william@yossarian.net>

woodruffw commented Feb 4, 2024

View reviewed changes

src/cryptography/hazmat/bindings/_rust/x509.pyi Outdated Show resolved Hide resolved

woodruffw commented Feb 4, 2024

View reviewed changes

src/rust/cryptography-x509-verification/src/policy/mod.rs Outdated Show resolved Hide resolved

woodruffw commented Feb 4, 2024

View reviewed changes

src/rust/src/x509/verify.rs Outdated Show resolved Hide resolved

woodruffw commented Feb 4, 2024

View reviewed changes

src/rust/src/x509/verify.rs Outdated Show resolved Hide resolved

implement ClientVerifier.verify

8a540d3

Signed-off-by: William Woodruff <william@yossarian.net>

woodruffw commented Feb 8, 2024

View reviewed changes

src/cryptography/x509/verification.py Outdated Show resolved Hide resolved

woodruffw commented Feb 8, 2024

View reviewed changes

src/rust/src/x509/verify.rs Outdated Show resolved Hide resolved

woodruffw commented Feb 8, 2024

View reviewed changes

src/rust/src/x509/verify.rs Outdated Show resolved Hide resolved

woodruffw added 2 commits February 8, 2024 13:07

verification: make Python 3.8 happy

b7761d6

Signed-off-by: William Woodruff <william@yossarian.net>

switch to a full VerifiedClient type

a9f24a8

Signed-off-by: William Woodruff <william@yossarian.net>

alex reviewed Feb 10, 2024

View reviewed changes

alex added this to the Forty Third Release milestone Feb 10, 2024

woodruffw mentioned this pull request Feb 10, 2024

policy: Policy::new is now Policy::server #10377

Merged

woodruffw added 6 commits February 11, 2024 11:12

Merge branch 'main' into ww/client-verification

d179b7e

Signed-off-by: William Woodruff <william@yossarian.net>

remove the SubjectOwner::None hack

6e09ac1

Signed-off-by: William Woodruff <william@yossarian.net>

docs: fix ClientVerifier

0b92cb5

Signed-off-by: William Woodruff <william@yossarian.net>

verification: replace match with if

00c0c6f

Signed-off-by: William Woodruff <william@yossarian.net>

return GNs directly, not whole extension

aeaceb2

Signed-off-by: William Woodruff <william@yossarian.net>

docs/verification: document UnsupportedGeneralNameType raise

dd89489

Signed-off-by: William Woodruff <william@yossarian.net>

woodruffw marked this pull request as ready for review February 11, 2024 14:36

vEpiphyte mentioned this pull request Feb 14, 2024

PyOpenSSL X509Store / Context parity in Cryptography #10393

Open

Merge remote-tracking branch 'upstream/main' into ww/client-verification

ee987d3

This was referenced Feb 26, 2024

verification: add RFC822Name #10487

Merged

verification: add RFC822Constraint #10497

Merged

woodruffw added 6 commits February 28, 2024 20:32

Merge remote-tracking branch 'upstream/main' into ww/client-verification

afc1e14

lib: RFC822 checks on NCs

0a49f04

Merge branch 'main' into ww/client-verification

e9cb771

test_limbo: enable client tests

83fedfd

tests: flake

63a8b3f

test_verification: more Python API coverage

12a5452

woodruffw added 4 commits March 6, 2024 21:37

Merge remote-tracking branch 'upstream/main' into ww/client-verification

0da5fd6

Merge remote-tracking branch 'upstream/main' into ww/client-verification

2c32109

verification: filter GNs by NC support

eeda511

woodruffw mentioned this pull request Mar 12, 2024

Allow verifying an x509 cert chain without making assertions about the subject name #10276

Closed

woodruffw added 2 commits March 13, 2024 15:54

Merge branch 'main' into ww/client-verification

93a502e

Signed-off-by: William Woodruff <william@yossarian.net>

docs/verification: remove old sentence

df2d3ef

Signed-off-by: William Woodruff <william@yossarian.net>

woodruffw changed the title ~~verification: WIP client verification skeleton~~ verification: client verification APIs Mar 13, 2024

woodruffw added 3 commits March 15, 2024 11:26

verification: ensure the right EKU for client/server paths

5e2cfe9

Signed-off-by: William Woodruff <william@yossarian.net>

Merge remote-tracking branch 'upstream/main' into ww/client-verification

986ae7f

test_limbo: fixup EKU assertion

4c9ac45

alex reviewed Mar 20, 2024

View reviewed changes

src/rust/cryptography-x509-verification/src/policy/mod.rs Outdated Show resolved Hide resolved

tests/x509/verification/test_limbo.py Outdated Show resolved Hide resolved

woodruffw added 2 commits March 20, 2024 20:29

Merge remote-tracking branch 'upstream/main' into ww/client-verification

7204e3f

verification: feedback

26f800a

alex approved these changes Mar 21, 2024

View reviewed changes

alex merged commit 4a3e7dc into pyca:main Mar 21, 2024
57 checks passed

woodruffw deleted the ww/client-verification branch March 21, 2024 01:00

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

verification: client verification APIs #10345

verification: client verification APIs #10345

woodruffw commented Feb 4, 2024 •

edited

Loading

alex commented Feb 4, 2024 via email

alex commented Feb 10, 2024

woodruffw commented Feb 11, 2024

woodruffw commented Feb 26, 2024

woodruffw commented Feb 28, 2024

woodruffw commented Mar 5, 2024

woodruffw commented Mar 20, 2024

verification: client verification APIs #10345

verification: client verification APIs #10345

Conversation

woodruffw commented Feb 4, 2024 • edited Loading

alex commented Feb 4, 2024 via email

alex commented Feb 10, 2024

woodruffw commented Feb 11, 2024

woodruffw commented Feb 26, 2024

woodruffw commented Feb 28, 2024

woodruffw commented Mar 5, 2024

woodruffw commented Mar 20, 2024

woodruffw commented Feb 4, 2024 •

edited

Loading