summaryrefslogtreecommitdiff
path: root/Modules/_ssl.c
Commit message (Collapse)AuthorAgeFilesLines
* bpo-31432: Revert unrelated code changes to _ssl.c and test_ssl (GH-7650)Ned Deily2018-06-111-2/+2
|
* bpo-31432: Clarify ssl CERT_NONE/OPTIONAL/REQUIRED docs. (GH-3530)Christian Heimes2018-06-111-2/+2
| | | | | | | | | The documentation for CERT_NONE, CERT_OPTIONAL, and CERT_REQUIRED were misleading and partly wrong. It fails to explain that OpenSSL behaves differently in client and server mode. Also OpenSSL does validate the cert chain everytime. With SSL_VERIFY_NONE a validation error is not fatal in client mode and does not request a client cert in server mode. Also discourage people from using CERT_OPTIONAL in client mode.
* Remove an unneeded call into OpenSSL (GH-6887)Alex Gaynor2018-05-161-1/+0
|
* bpo-32257: Add ssl.OP_NO_RENEGOTIATION (GH-5904)Christian Heimes2018-05-151-0/+4
| | | | | | | | The ssl module now contains OP_NO_RENEGOTIATION constant, available with OpenSSL 1.1.0h or 1.1.1. Note, OpenSSL 1.1.0h hasn't been released yet. Signed-off-by: Christian Heimes <christian@python.org>
* Fixed an unused variable warning introduced in GH-6800 (GH-6816)Alex Gaynor2018-05-141-1/+0
|
* Remove `ifdef` check for an OpenSSL version (0.9.6) we don't support (GH-6800)Alex Gaynor2018-05-141-5/+2
|
* bpo-33136: Harden ssl module against CVE-2018-8970 (GH-6229)Christian Heimes2018-03-251-3/+4
| | | | | | | Harden ssl module against LibreSSL CVE-2018-8970. X509_VERIFY_PARAM_set1_host() is called with an explicit namelen. A new test ensures that NULL bytes are not allowed. Signed-off-by: Christian Heimes <christian@python.org>
* bpo-33127: Compatibility patch for LibreSSL 2.7.0 (GH-6210)Christian Heimes2018-03-241-6/+16
| | | | | | | | | | LibreSSL 2.7 introduced OpenSSL 1.1.0 API. The ssl module now detects LibreSSL 2.7 and only provides API shims for OpenSSL < 1.1.0 and LibreSSL < 2.7. Documentation updates and fixes for failing tests will be provided in another patch set. Signed-off-by: Christian Heimes <christian@python.org>
* bpo-31453: Add setter for min/max protocol version (#5259)Christian Heimes2018-02-271-22/+212
| | | | | | | | | | | | OpenSSL 1.1 has introduced a new API to set the minimum and maximum supported protocol version. The API is easier to use than the old OP_NO_TLS1 option flags, too. Since OpenSSL has no call to set minimum version to highest supported, the implementation emulate maximum_version = MINIMUM_SUPPORTED and minimum_version = MAXIMUM_SUPPORTED by figuring out the minumum and maximum supported version at compile time. Signed-off-by: Christian Heimes <christian@python.org>
* bpo-32947: OpenSSL 1.1.1-pre1 / TLS 1.3 fixes (#5663)Christian Heimes2018-02-271-0/+4
| | | | | | | | | | | | | | | | | | * bpo-32947: OpenSSL 1.1.1-pre1 / TLS 1.3 fixes Misc fixes and workarounds for compatibility with OpenSSL 1.1.1-pre1 and TLS 1.3 support. With OpenSSL 1.1.1, Python negotiates TLS 1.3 by default. Some test cases only apply to TLS 1.2. Other tests currently fail because the threaded or async test servers stop after failure. I'm going to address these issues when OpenSSL 1.1.1 reaches beta. OpenSSL 1.1.1 has added a new option OP_ENABLE_MIDDLEBOX_COMPAT for TLS 1.3. The feature is enabled by default for maximum compatibility with broken middle boxes. Users should be able to disable the hack and CPython's test suite needs it to verify default options. Signed-off-by: Christian Heimes <christian@python.org>
* bpo-30622: Fix NPN for OpenSSL 1.1.1-pre1 (#5876)Christian Heimes2018-02-251-20/+25
| | | Signed-off-by: Christian Heimes <christian@python.org>
* bpo-30622: Improve NPN support detection (#5859)Christian Heimes2018-02-241-8/+21
| | | | | | The ssl module now detects missing NPN support in LibreSSL. Co-Authored-By: Bernard Spil <brnrd@FreeBSD.org> Signed-off-by: Christian Heimes <christian@python.org>
* bpo-24334: Cleanup SSLSocket (#5252)Christian Heimes2018-02-241-30/+60
| | | | | | | | | | | | | * The SSLSocket is no longer implemented on top of SSLObject to avoid an extra level of indirection. * Owner and session are now handled in the internal constructor. * _ssl._SSLSocket now uses the same method names as SSLSocket and SSLObject. * Channel binding type check is now handled in C code. Channel binding is always available. The patch also changes the signature of SSLObject.__init__(). In my opinion it's fine. A SSLObject is not a user-constructable object. SSLContext.wrap_bio() is the only valid factory.
* [bpo-28414] Make all hostnames in SSL module IDN A-labels (GH-5128)Christian Heimes2018-02-231-54/+77
| | | | | | | | | | | | Previously, the ssl module stored international domain names (IDNs) as U-labels. This is problematic for a number of reasons -- for example, it made it impossible for users to use a different version of IDNA than the one built into Python. After this change, we always convert to A-labels as soon as possible, and use them for all internal processing. In particular, server_hostname attribute is now an A-label, and on the server side there's a new sni_callback that receives the SNI servername as an A-label rather than a U-label.
* bpo-31429: Define TLS cipher suite on build time (#3532)Christian Heimes2018-01-291-1/+34
| | | | | | | | | | | | | Until now Python used a hard coded white list of default TLS cipher suites. The old approach has multiple downsides. OpenSSL's default selection was completely overruled. Python did neither benefit from new cipher suites (ChaCha20, TLS 1.3 suites) nor blacklisted cipher suites. For example we used to re-enable 3DES. Python now defaults to OpenSSL DEFAULT cipher suite selection and black lists all unwanted ciphers. Downstream vendors can override the default cipher list with --with-ssl-default-suites. Signed-off-by: Christian Heimes <christian@python.org>
* bpo-31399: Let OpenSSL verify hostname and IP address (#3462)Christian Heimes2018-01-271-32/+140
| | | | | | | | | | | | | | | bpo-31399: Let OpenSSL verify hostname and IP The ssl module now uses OpenSSL's X509_VERIFY_PARAM_set1_host() and X509_VERIFY_PARAM_set1_ip() API to verify hostname and IP addresses. * Remove match_hostname calls * Check for libssl with set1_host, libssl must provide X509_VERIFY_PARAM_set1_host() * Add documentation for OpenSSL 1.0.2 requirement * Don't support OpenSSL special mode with a leading dot, e.g. ".example.org" matches "www.example.org". It's not standard conform. * Add hostname_checks_common_name Signed-off-by: Christian Heimes <christian@python.org>
* bpo-32598: Use autoconf to detect usable OpenSSL (#5242)Christian Heimes2018-01-201-0/+7
| | | | | | | | | | | | | | Add https://www.gnu.org/software/autoconf-archive/ax_check_openssl.html to auto-detect compiler flags, linker flags and libraries to compile OpenSSL extensions. The M4 macro uses pkg-config and falls back to manual detection. Add autoconf magic to detect usable X509_VERIFY_PARAM_set1_host() and related functions. Refactor setup.py to use new config vars to compile _ssl and _hashlib modules. Signed-off-by: Christian Heimes <christian@python.org>
* completly -> completely (#3999) (closes bpo-31788)Semen Zhydenko2017-10-151-1/+1
|
* bpo-31431: SSLContext.check_hostname auto-sets CERT_REQUIRED (#3531)Christian Heimes2017-09-151-4/+4
| | | Signed-off-by: Christian Heimes <christian@python.org>
* _ssl_: Fix compiler warning (#3559)Victor Stinner2017-09-141-1/+1
| | | | | | | Cast Py_buffer.len (Py_ssize_t, signed) to size_t (unsigned) to prevent the following warning: Modules/_ssl.c:3089:21: warning: comparison between signed and unsigned integer expressions [-Wsign-compare]
* bpo-31400: Improve SSL error handling on Windows (#3463)Steve Dower2017-09-081-10/+48
| | | | | | * bpo-31392: Improve SSL error handling on Windows * Remove unnecessary Windows mention in NEWS
* bpo-28182: restore backwards compatibility (#3464)Christian Heimes2017-09-081-0/+5
| | | | | b3ad0e5 broke backwards compatibility with OpenSSL < 1.0.2. Signed-off-by: Christian Heimes <christian@python.org>
* bpo-28182: Expose OpenSSL verification results (#3412)Christian Heimes2017-09-081-17/+91
| | | | | | | | | The SSL module now raises SSLCertVerificationError when OpenSSL fails to verify the peer's certificate. The exception contains more information about the error. Original patch by Chi Hsuan Yen Signed-off-by: Christian Heimes <christian@python.org>
* bpo-29136: Add TLS 1.3 cipher suites and OP_NO_TLSv1_3 (#1363)Christian Heimes2017-09-071-0/+13
| | | | | | | | | | | | | | | | * bpo-29136: Add TLS 1.3 support TLS 1.3 introduces a new, distinct set of cipher suites. The TLS 1.3 cipher suites don't overlap with cipher suites from TLS 1.2 and earlier. Since Python sets its own set of permitted ciphers, TLS 1.3 handshake will fail as soon as OpenSSL 1.1.1 is released. Let's enable the common AES-GCM and ChaCha20 suites. Additionally the flag OP_NO_TLSv1_3 is added. It defaults to 0 (no op) with OpenSSL prior to 1.1.1. This allows applications to opt-out from TLS 1.3 now. Signed-off-by: Christian Heimes <christian@python.org>
* bpo-28958: Improve SSLContext error reporting. (#3414)Christian Heimes2017-09-071-2/+1
| | | Signed-off-by: Christian Heimes <christian@python.org>
* bpo-31370: Remove support for threads-less builds (#3385)Antoine Pitrou2017-09-071-29/+1
| | | | | | * Remove Setup.config * Always define WITH_THREAD for compatibility.
* bpo-29781: Fix SSLObject.version before handshake (#3364)Christian Heimes2017-09-051-0/+4
| | | | | | SSLObject.version() now correctly returns None when handshake over BIO has not been performed yet. Signed-off-by: Christian Heimes <christian@python.org>
* bpo-30102: Call OPENSSL_add_all_algorithms_noconf (#3112)Christian Heimes2017-09-051-1/+5
| | | | | | | | The ssl and hashlib modules now call OPENSSL_add_all_algorithms_noconf() on OpenSSL < 1.1.0. The function detects CPU features and enables optimizations on some CPU architectures such as POWER8. Patch is based on research from Gustavo Serra Scalet. Signed-off-by: Christian Heimes <christian@python.org>
* bpo-30502: Fix handling of long oids in ssl. (#2909)Serhiy Storchaka2017-09-051-43/+47
|
* bpo-30622: Change NPN detection: (#2079)Melvyn Sopacua2017-09-041-7/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Change NPN detection: Version breakdown, support disabled (pre-patch/post-patch): - pre-1.0.1: OPENSSL_NPN_NEGOTIATED will not be defined -> False/False - 1.0.1 and 1.0.2: OPENSSL_NPN_NEGOTIATED will not be defined -> False/False - 1.1.0+: OPENSSL_NPN_NEGOTIATED will be defined and OPENSSL_NO_NEXTPROTONEG will be defined -> True/False Version breakdown support enabled (pre-patch/post-patch): - pre-1.0.1: OPENSSL_NPN_NEGOTIATED will not be defined -> False/False - 1.0.1 and 1.0.2: OPENSSL_NPN_NEGOTIATED will be defined and OPENSSL_NO_NEXTPROTONEG will not be defined -> True/True - 1.1.0+: OPENSSL_NPN_NEGOTIATED will be defined and OPENSSL_NO_NEXTPROTONEG will not be defined -> True/True * Refine NPN guard: - If NPN is disabled, but ALPN is available we need our callback - Make clinic's ssl behave the same way This created a working ssl module for me, with NPN disabled and ALPN enabled for OpenSSL 1.1.0f. Concerns to address: The initial commit for NPN support into OpenSSL [1], had the OPENSSL_NPN_* variables defined inside the OPENSSL_NO_NEXTPROTONEG guard. The question is if that ever made it into a release. This would need an ugly hack, something like: #if defined(OPENSSL_NO_NEXTPROTONEG) && \ !defined(OPENSSL_NPN_NEGOTIATED) # define OPENSSL_NPN_UNSUPPORTED 0 # define OPENSSL_NPN_NEGOTIATED 1 # define OPENSSL_NPN_NO_OVERLAP 2 #endif [1] https://github.com/openssl/openssl/commit/68b33cc5c7
* bpo-31095: fix potential crash during GC (GH-2974)INADA Naoki2017-08-241-0/+3
|
* bpo-9566: Fixed _ssl module warnings (#2495)Segev Finer2017-07-261-6/+13
| | | | | | | | * bpo-9566: Fixed some _ssl warnings * bpo-9566: _ssl: Fixup the fixes and also fix the remainings warnings * Add a comment about the downcast
* [bpo-30916] Pre-build OpenSSL and Tcl/Tk for Windows (#2688)Steve Dower2017-07-171-1/+37
| | | Updates ssl and tkinter projects to use pre-built externals
* Regenerate Argument Clinic code for bpo-19180. (#2073)Serhiy Storchaka2017-06-101-1/+1
|
* bpo-19180: Updated references for RFC 1750, RFC 3280 & RFC 4366 (GH-148)Chandan Kumar2017-06-091-1/+1
| | | | | * RFC 1750 has been been obsoleted by RFC 4086. * RFC 3280 has been obsoleted by RFC 5280. * RFC 4366 has been obsoleted by RFC 6066.
* bpo-30594: Fixed refcounting in newPySSLSocket (#1992)Nathaniel J. Smith2017-06-081-2/+1
| | | If pass a server_hostname= that fails IDNA decoding to SSLContext.wrap_socket or SSLContext.wrap_bio, then the SSLContext object had a spurious Py_DECREF called on it, eventually leading to segfaults.
* Simplify X.509 extension handling code (#1855)Alex Gaynor2017-06-061-30/+4
| | | | | | | | * Simplify X.509 extension handling code The previous implementation had grown organically over time, as OpenSSL's API evolved. * Delete even more code
* bpo-29334: Fix ssl.getpeercert for auto-handshake (#1769)Christian Heimes2017-05-231-19/+11
| | | | | | | | | | | | Drop handshake_done and peer_cert members from PySSLSocket struct. The peer certificate can be acquired from *SSL directly. SSL_get_peer_certificate() does not trigger any network activity. Instead of manually tracking the handshake state, simply use SSL_is_init_finished(). In combination these changes fix auto-handshake for non-blocking MemoryBIO connections. Signed-off-by: Christian Heimes <christian@python.org>
* bpo-30022: Get rid of using EnvironmentError and IOError (except test… (#1051)Serhiy Storchaka2017-04-161-3/+3
|
* bpo-29738: Fix memory leak in _get_crl_dp (GH-526)Olivier Vielpeau2017-04-141-7/+1
| | | | | | | | | * Remove conditional on free of `dps`, since `dps` is now allocated for all versions of OpenSSL * Remove call to `x509_check_ca` since it was only used to cache the `crldp` field of the certificate CRL_DIST_POINTS_free is available in all supported versions of OpenSSL (recent 0.9.8+) and LibreSSL.
* bpo-6532: Make the thread id an unsigned integer. (#781)Serhiy Storchaka2017-03-231-2/+1
| | | | | | | | | | | * bpo-6532: Make the thread id an unsigned integer. From C API side the type of results of PyThread_start_new_thread() and PyThread_get_thread_ident(), the id parameter of PyThreadState_SetAsyncExc(), and the thread_id field of PyThreadState changed from "long" to "unsigned long". * Restore a check in thread_get_ident().
* bpo-29697: Don't use OpenSSL <1.0.2 fallback on 1.1+ (GH-395)Donald Stufft2017-03-021-2/+2
|
* Issue #28999: Use Py_RETURN_NONE, Py_RETURN_TRUE and Py_RETURN_FALSE whereverSerhiy Storchaka2017-01-231-4/+2
| | | | possible. Patch is writen with Coccinelle.
* Use _PyObject_CallNoArg()Victor Stinner2016-12-061-1/+1
| | | | | | | Replace: PyObject_CallFunctionObjArgs(callable, NULL) with: _PyObject_CallNoArg(callable)
* Backed out changeset b9c9691c72c5Victor Stinner2016-12-041-1/+1
| | | | | | Issue #28858: The change b9c9691c72c5 introduced a regression. It seems like _PyObject_CallArg1() uses more stack memory than PyObject_CallFunctionObjArgs().
* Replace PyObject_CallFunctionObjArgs() with fastcallVictor Stinner2016-12-011-1/+1
| | | | | | | | | | | | | | * PyObject_CallFunctionObjArgs(func, NULL) => _PyObject_CallNoArg(func) * PyObject_CallFunctionObjArgs(func, arg, NULL) => _PyObject_CallArg1(func, arg) PyObject_CallFunctionObjArgs() allocates 40 bytes on the C stack and requires extra work to "parse" C arguments to build a C array of PyObject*. _PyObject_CallNoArg() and _PyObject_CallArg1() are simpler and don't allocate memory on the C stack. This change is part of the fastcall project. The change on listsort() is related to the issue #23507.
* TypoChristian Heimes2016-09-241-1/+1
|
* Finish GC code for SSLSession and increase test coverageChristian Heimes2016-09-241-4/+9
|
* Issue #28188: Use PyMem_Calloc() to get rid of a type-limits warning and an ↵Christian Heimes2016-09-131-3/+2
| | | | extra memset() call in _ssl.c.
* Issue #27866: Fix refleak in cipher_to_dict()Victor Stinner2016-09-121-12/+1
|
View Lorry Controller Status