Fix order of arguments for key check

Due to a bug in python-openssl 0.14, no exception is
thrown when checking a certificate against a private
key if they are given to the context in the wrong
order. This patch fixes the order and also removes
some unnecessarily convoluted code.

Signed-off-by: Helga Velroyen <helgav@google.com>
Reviewed-by: Klaus Aehlig <aehlig@google.com>

diff --git a/lib/tools/node_daemon_setup.py b/lib/tools/node_daemon_setup.py
index 3d1a0d4..3eec177 100644 (file)
--- a/lib/tools/node_daemon_setup.py
+++ b/lib/tools/node_daemon_setup.py
@@ -115,9 +115,8 @@ def _VerifyCertificate(cert_pem, _check_fn=utils.CheckNodeCertificate):
 
   # Check certificate with given key; this detects cases where the key given on
   # stdin doesn't match the certificate also given on stdin
-  x509_check_fn = utils.PrepareX509CertKeyCheck(cert, key)
   try:
-    x509_check_fn()
+    utils.X509CertKeyCheck(cert, key)
   except OpenSSL.SSL.Error:
     raise errors.X509CertError("(stdin)",
                                "Certificate is not signed with given key")

diff --git a/lib/utils/x509.py b/lib/utils/x509.py
index 7c54080..6ab62c4 100644 (file)
--- a/lib/utils/x509.py
+++ b/lib/utils/x509.py
@@ -340,8 +340,8 @@ def ExtractX509Certificate(pem):
           OpenSSL.crypto.dump_certificate(OpenSSL.crypto.FILETYPE_PEM, cert))
 
 
-def PrepareX509CertKeyCheck(cert, key):
-  """Get function for verifying certificate with a certain private key.
+def X509CertKeyCheck(cert, key):
+  """Function for verifying certificate with a certain private key.
 
   @type key: OpenSSL.crypto.PKey
   @param key: Private key object
@@ -353,10 +353,9 @@ def PrepareX509CertKeyCheck(cert, key):
 
   """
   ctx = OpenSSL.SSL.Context(OpenSSL.SSL.TLSv1_METHOD)
-  ctx.use_privatekey(key)
   ctx.use_certificate(cert)
-
-  return ctx.check_privatekey
+  ctx.use_privatekey(key)
+  ctx.check_privatekey()
 
 
 def CheckNodeCertificate(cert, _noded_cert_file=pathutils.NODED_CERT_FILE):
@@ -396,9 +395,8 @@ def CheckNodeCertificate(cert, _noded_cert_file=pathutils.NODED_CERT_FILE):
                                "Unable to load private key: %s" % err)
 
   # Check consistency of server.pem file
-  check_fn = PrepareX509CertKeyCheck(noded_cert, noded_key)
   try:
-    check_fn()
+    X509CertKeyCheck(noded_cert, noded_key)
   except OpenSSL.SSL.Error:
     # This should never happen as it would mean the certificate in server.pem
     # is out of sync with the private key stored in the same file
@@ -406,9 +404,8 @@ def CheckNodeCertificate(cert, _noded_cert_file=pathutils.NODED_CERT_FILE):
                                "Certificate does not match with private key")
 
   # Check with supplied certificate with local key
-  check_fn = PrepareX509CertKeyCheck(cert, noded_key)
   try:
-    check_fn()
+    X509CertKeyCheck(cert, noded_key)
   except OpenSSL.SSL.Error:
     raise errors.GenericError("Given cluster certificate does not match"
                               " local key")