updated modulus blacklisting stuff

server-ca/CSR.py

@@ -60,6 +60,12 @@ def blacklisted(key):
     pkey = M2Crypto.EVP.PKey()
     pkey.assign_rsa(pubkey)
     modulus = pkey.get_modulus()
+    # The modulus is now in hexadecimal, all uppercase.
+    modulus = hashlib.sha1("Modulus=%s\n" % modulus).hexdigest()[20:]
+    # This is the format in which moduli are represented by the
+    # openssl-blacklist package (using a hash of the literal output
+    # of the openssl -rsa -modulus -pubin -noout command, including
+    # newline).
     return modulus in forbidden_moduli
 
 def csr_goodkey(csr):

server-ca/blacklisting/import-openssl-blacklist.py

@@ -0,0 +1,20 @@
+#!/usr/bin/env python
+
+# This imports a Debian OpenSSL modulus blacklist file into the
+# Redis set "debian_moduli".  Specify one or more files on the
+# command line to import them.  Importing will require a little
+# under a minute per file.
+
+# E.g.,
+# python import-openssl-blacklist.py /usr/share/openssl-blacklist/blacklist.*
+# will import everything (including 1024 and 512 bit moduli, which might be
+# rejected for other reasons).
+
+import sys, redis
+
+r = redis.Redis()
+
+for f in sys.argv[1:]:
+    for line in open(f):
+        if "#" not in line and len(line.rstrip()) == 20:
+            r.sadd("debian_moduli", line.rstrip())

server-ca/blacklists.py

@@ -4,8 +4,17 @@ import redis
 
 r = redis.Redis()
 
-# Moduli should be stored in Redis in hexadecimal, all uppercase.  If these
+# You can test strings for membership in instances of these classes
-# sets don't exist, sismember returns False (not an exception).
+# in order to search modulus and name blacklists kept in Redis.
+
+# Moduli should be stored in Redis in openssl-vulnkey(1) format,
+# which is the rightmost 20 characters of the SHA1 hash
+# of "Modulus=%s\n" % modulus.upper().
+#
+# If these sets don't exist, sismember returns False (not an exception).
+# Redis set membership testing is very fast.  These classes are just
+# making particular Redis sets look like Python sets or dictionaries for
+# membership testing purposes.
 
 class forbidden_moduli(object):
     def __contains__(self, modulus):