changeset 580a87dafae4 in /home/hg/repos/gajim

author: Yann Leboulanger asterix@lagaule.org branches: gajim_0.16 details:http://hg.gajim.org/gajim?cmd=changeset;node=580a87dafae4 description: [fedor] improve Jingle XTLS security. Fixes #7544

diffstat:

src/common/jingle_xtls.py | 19 ++++++++++++------- 1 files changed, 12 insertions(+), 7 deletions(-)

diffs (63 lines):

diff -r 227c979bebc0 -r 580a87dafae4 src/common/jingle_xtls.py --- a/src/common/jingle_xtls.py Tue Nov 05 15:04:49 2013 +0400 +++ b/src/common/jingle_xtls.py Tue Nov 05 11:21:56 2013 +0100 @@ -92,7 +92,10 @@ """ constructs and returns the context objects """ - ctx = SSL.Context(SSL.TLSv1_METHOD) + ctx = SSL.Context(SSL.SSLv23_METHOD) + flags = (SSL.OP_NO_SSLv2 | SSL.OP_NO_SSLv3 | SSL.OP_SINGLE_DH_USE) + ctx.set_options(flags) + ctx.set_cipher_list('HIGH:!aNULL:!eNULL')

if fingerprint == 'server': # for testing purposes only ctx.set_verify(SSL.VERIFY_NONE|SSL.VERIFY_FAIL_IF_NO_PEER_CERT, @@ -174,12 +177,12 @@ pkey.generate_key(type, bits) return pkey

-def createCertRequest(pkey, digest="md5", **name): +def createCertRequest(pkey, digest="sha1", **name): """ Create a certificate request.

Arguments: pkey - The key to associate with the request - digest - Digestion method to use for signing, default is md5 + digest - Digestion method to use for signing, default is sha1 **name - The name of the subject of the request, possible arguments are: C - Country name @@ -201,7 +204,7 @@ req.sign(pkey, digest) return req

-def createCertificate(req, (issuerCert, issuerKey), serial, (notBefore, notAfter), digest="md5"): +def createCertificate(req, (issuerCert, issuerKey), serial, (notBefore, notAfter), digest="sha1"): """ Generate a certificate given a certificate request.

@@ -213,7 +216,7 @@ starts being valid notAfter - Timestamp (relative to now) when the certificate stops being valid - digest - Digest method to use for signing, default is md5 + digest - Digest method to use for signing, default is sha1 Returns: The signed certificate in an X509 object """ cert = crypto.X509() @@ -233,10 +236,12 @@ and '.cert' extensions CN : common name """ - key = createKeyPair(TYPE_RSA, 1024) + key = createKeyPair(TYPE_RSA, 4096) req = createCertRequest(key, CN=CN) cert = createCertificate(req, (req, key), 0, (0, 60*60*24*365*5)) # five years - open(filepath + '.pkey', 'w').write(crypto.dump_privatekey( + private_key_file = open(filepath + '.pkey', 'w') + os.chmod(filepath + '.pkey', 0600) + private_key_file.write(crypto.dump_privatekey( crypto.FILETYPE_PEM, key)) open(filepath + '.cert', 'w').write(crypto.dump_certificate( crypto.FILETYPE_PEM, cert))