Identify elliptic curves by short name, not NID

Using NIDs is awkward and requires updating pyOpenSSL every time a new
curve is added.  This approach avoids needing to update pyOpenSSL
each time a new curve is added, and it results in more readable code
and a more readable dict ELLIPTIC_CURVE_DESCRIPTIONS.

1 files changed, 15 insertions, 5 deletions

diff --git a/OpenSSL/SSL.py b/OpenSSL/SSL.py
index 602a98c..f6d62d4 100644
--- a/OpenSSL/SSL.py
+++ b/OpenSSL/SSL.py
@@ -271,7 +271,8 @@ if _Cryptography_HAS_EC:
     _num_curves = _lib.EC_get_builtin_curves(_ffi.NULL, 0)
     _curves = _ffi.new('EC_builtin_curve[]', _num_curves)
     if _lib.EC_get_builtin_curves(_curves, _num_curves) == _num_curves:
-        ELLIPTIC_CURVE_DESCRIPTIONS = dict((c.nid, _ffi.string(c.comment))
+        ELLIPTIC_CURVE_DESCRIPTIONS = dict((_ffi.string(_lib.OBJ_nid2sn(c.nid)),
+                                            _ffi.string(c.comment))
                                            for c in _curves)
     del _num_curves
     del _curves
@@ -749,16 +750,25 @@ class Context(object):
         _lib.SSL_CTX_set_tmp_dh(self._context, dh)
 
 
-    def set_tmp_ecdh_by_curve_name(self, curve_name):
+    def set_tmp_ecdh_curve(self, curve_name):
         """
         Select a curve to use for ECDHE key exchange.
 
-        :param curve_name: One of the named curve constants.
-        :type curve_name: int
+        The valid values of *curve_name* are the keys in
+        :py:data:OpenSSL.SSL.ELLIPTIC_CURVE_DESCRIPTIONS.
+
+        Raises a ``ValueError`` if the linked OpenSSL was not compiled with
+        elliptical curve support, or the specified curve is not available.
+
+        :param curve_name: The 'short name' of a curve, e.g. 'prime256v1'
+        :type curve_name: str
         :return: None
         """
         if _lib.Cryptography_HAS_EC:
-            ecdh = _lib.EC_KEY_new_by_curve_name(curve_name)
+            nid = _lib.OBJ_sn2nid(curve_name)
+            if nid == _lib.NID_undef:
+                raise ValueError("No such OpenSSL object '%s'" % curve_name)
+            ecdh = _lib.EC_KEY_new_by_curve_name(nid)
             if ecdh == _ffi.NULL:
                 raise ValueError(
                     "OpenSSL could not load the requested elliptic curve"