##
#
+from __future__ import print_function
+
import functools
import os
import tempfile
def convert_public_key(key):
keyconvert_path = "/usr/bin/keyconvert.py"
if not os.path.isfile(keyconvert_path):
- raise IOError, "Could not find keyconvert in %s" % keyconvert_path
+ raise IOError("Could not find keyconvert in %s" % keyconvert_path)
# we can only convert rsa keys
if "ssh-dss" in key:
- raise Exception, "keyconvert: dss keys are not supported"
+ raise Exception("keyconvert: dss keys are not supported")
(ssh_f, ssh_fn) = tempfile.mkstemp()
ssl_fn = tempfile.mktemp()
# that it can be expected to see why it failed.
# TODO: for production, cleanup the temporary files
if not os.path.exists(ssl_fn):
- raise Exception, "keyconvert: generated certificate not found. keyconvert may have failed."
+ raise Exception("keyconvert: generated certificate not found. keyconvert may have failed.")
k = Keypair()
try:
# prob not necc since this cert itself is junk but still...
m2x509.set_version(2)
junk_key = Keypair(create=True)
- m2x509.sign(pkey=junk_key.get_m2_pkey(), md="sha1")
+ m2x509.sign(pkey=junk_key.get_m2_pubkey(), md="sha1")
# convert the m2 x509 cert to a pyopenssl x509
m2pem = m2x509.as_pem()
##
# Return an M2Crypto key object
- def get_m2_pkey(self):
+ def get_m2_pubkey(self):
if not self.m2key:
self.m2key = M2Crypto.EVP.load_key_string(self.as_pem())
return self.m2key
# Returns a string containing the public key represented by this object.
def get_pubkey_string(self):
- m2pkey = self.get_m2_pkey()
+ m2pkey = self.get_m2_pubkey()
return base64.b64encode(m2pkey.as_der())
##
return self.as_pem() == pkey.as_pem()
def sign_string(self, data):
- k = self.get_m2_pkey()
+ k = self.get_m2_pubkey()
k.sign_init()
k.sign_update(data)
return base64.b64encode(k.sign_final())
def verify_string(self, data, sig):
- k = self.get_m2_pkey()
+ k = self.get_m2_pubkey()
k.verify_init()
k.verify_update(data)
return M2Crypto.m2.verify_final(k.ctx, base64.b64decode(sig), k.pkey)
return getattr(self,'filename',None)
def dump (self, *args, **kwargs):
- print self.dump_string(*args, **kwargs)
+ print(self.dump_string(*args, **kwargs))
def dump_string (self):
result=""
if self.isCA != None:
# Can't double set properties
- raise Exception, "Cannot set basicConstraints CA:?? more than once. Was %s, trying to set as %s" % (self.isCA, val)
+ raise Exception("Cannot set basicConstraints CA:?? more than once. Was %s, trying to set as %s" % (self.isCA, val))
self.isCA = val
if val:
def set_data(self, str, field='subjectAltName'):
# pyOpenSSL only allows us to add extensions, so if we try to set the
# same extension more than once, it will not work
- if self.data.has_key(field):
- raise "Cannot set ", field, " more than once"
+ if field in self.data:
+ raise Exception("Cannot set {} more than once".format(field))
self.data[field] = str
self.add_extension(field, 0, str)
# Return the data string that was previously set with set_data
def get_data(self, field='subjectAltName'):
- if self.data.has_key(field):
+ if field in self.data:
return self.data[field]
try:
# @param pkey is a Keypair object representing a public key. If Pkey
# did not sign the certificate, then an exception will be thrown.
- def verify(self, pkey):
+ def verify(self, pubkey):
# pyOpenSSL does not have a way to verify signatures
m2x509 = X509.load_cert_string(self.save_to_string())
- m2pkey = pkey.get_m2_pkey()
+ m2pubkey = pubkey.get_m2_pubkey()
# verify it
- return m2x509.verify(m2pkey)
+ # verify returns -1 or 0 on failure depending on how serious the
+ # error conditions are
+ return m2x509.verify(m2pubkey) == 1
# XXX alternatively, if openssl has been patched, do the much simpler:
# try:
return getattr(self,'filename',None)
def dump (self, *args, **kwargs):
- print self.dump_string(*args, **kwargs)
+ print(self.dump_string(*args, **kwargs))
def dump_string (self,show_extensions=False):
result = ""