Mirror
/
cpython
mirror of https://github.com/python/cpython
4
1
Fork 0
Code Issues Releases Wiki Activity
101,934 Commits 7 Branches 587 Tags 2.3 GiB
Commit Graph

445 Commits

Author SHA1 Message Date
Benjamin Peterson 8791d697e0 fix assertions after ciphers were changed 2015-01-07 14:29:45 -06:00
Benjamin Peterson f78b78aed4 rc4 is a long time favorite 2015-01-07 14:21:22 -06:00
Benjamin Peterson 438a8db763 everyone should support AES ciphers 2015-01-07 13:28:40 -06:00
Benjamin Peterson 9f6eceab46 include some more ciphers 2015-01-07 12:59:20 -06:00
Benjamin Peterson aacd524118 force test server to speak tlsv1 2015-01-07 11:42:38 -06:00
Benjamin Peterson e27a421354 remove apparently wrong assertion about des bit size 2015-01-07 11:33:51 -06:00
Benjamin Peterson 4cb17812d9 expose the client's cipher suites from the handshake (closes #23186) 2015-01-07 11:14:26 -06:00
Victor Stinner fcfed19913 Issue #21356: Make ssl.RAND_egd() optional to support LibreSSL. The 
availability of the function is checked during the compilation. Patch written
by Bernard Spil.
 2015-01-06 13:54:58 +01:00
Victor Stinner 789b805700 test_ssl: add more debug to investigate test_openssl_version() failure on 
OpenBSD with LibreSSL.
 2015-01-06 11:51:06 +01:00
Victor Stinner 3f7e064b2b Issue #22935: Fix test_ssl when the SSLv3 protocol is not supported 2014-12-12 12:27:08 +01:00
Benjamin Peterson e32467cf6a allow ssl module to compile if openssl doesn't support SSL 3 (closes #22935) 
Patch by Kurt Roeckx.
 2014-12-05 21:59:35 -05:00
Benjamin Peterson 7243b574e5 don't require OpenSSL SNI to pass hostname to ssl functions (#22921) 
Patch by Donald Stufft.
 2014-11-23 17:04:34 -06:00
Victor Stinner 648b862017 Issue #22935: Fix test_ssl when the SSLv3 protocol is not supported 2014-12-12 12:23:59 +01:00
Benjamin Peterson 22293df016 merge 3.4 (#22935) 2014-12-05 22:11:33 -05:00
Victor Stinner beeb512fe1 Issue #21356: Make ssl.RAND_egd() optional to support LibreSSL. The 
availability of the function is checked during the compilation.

Patch written by Bernard Spil.
 2014-11-28 13:28:25 +01:00
Benjamin Peterson f9284ae8ed merge 3.4 (#22921) 2014-11-23 17:06:39 -06:00
Benjamin Peterson 98e1b9158c merge 3.4 2014-11-03 21:06:07 -05:00
Benjamin Peterson 1ea070e561 test that keyfile can be None 2014-11-03 21:05:01 -05:00
Benjamin Peterson 1cca273669 merge 3.4 (#22417) 2014-11-03 14:36:48 -05:00
Benjamin Peterson 4ffb075271 PEP 476: enable HTTPS certificate verification by default (#22417) 
Patch by Alex Gaynor with some modifications by me.
 2014-11-03 14:29:33 -05:00
Antoine Pitrou b1fdf47ff5 Issue #21965: Add support for in-memory SSL to the ssl module. 
Patch by Geert Jansen.
 2014-10-05 20:41:53 +02:00
Benjamin Peterson 91b62c4a8a merge 3.4 2014-10-03 18:17:30 -04:00
Benjamin Peterson 91244e01bb separate cert loading tests into Windows and non-Windows cases 2014-10-03 18:17:15 -04:00
Benjamin Peterson 8b9cfa1066 merge 3.4 (#22449) 2014-10-03 17:33:45 -04:00
Benjamin Peterson 5915b0f924 also use openssl envvars to find certs on windows (closes #22449) 
Patch by Christian Heimes and Alex Gaynor.
 2014-10-03 17:27:05 -04:00
Antoine Pitrou 47e40429fb Issue #20421: Add a .version() method to SSL sockets exposing the actual protocol version in use. 2014-09-04 21:00:10 +02:00
Charles-François Natali 6e20460dc6 Issue #21566: Make use of socket.listen() default backlog. 2014-07-23 19:28:13 +01:00
Antoine Pitrou 26408df88f Issue #21976: Fix test_ssl to accept LibreSSL version strings. 
Thanks to William Orr.
 2014-07-21 18:37:36 -04:00
Antoine Pitrou dfab935c74 Issue #21976: Fix test_ssl to accept LibreSSL version strings. 
Thanks to William Orr.
 2014-07-21 18:35:01 -04:00
Giampaolo Rodola' 915d14190e fix issue #17552: add socket.sendfile() method allowing to send a file over a socket by using high-performance os.sendfile() on UNIX. Patch by Giampaolo Rodola'· 2014-06-11 03:54:30 +02:00
Antoine Pitrou b4bebdafe3 Issue #20951: SSLSocket.send() now raises either SSLWantReadError or SSLWantWriteError on a non-blocking socket if the operation would block. Previously, it would return 0. 
Patch by Nikolaus Rath.
 2014-04-29 10:03:28 +02:00
Antoine Pitrou c695c95626 Issue #19940: ssl.cert_time_to_seconds() now interprets the given time string in the UTC timezone (as specified in RFC 5280), not the local timezone. 
Patch by Akira.
 2014-04-28 20:57:36 +02:00
Antoine Pitrou 172f025bed Issue #21068: The ssl.PROTOCOL* constants are now enum members. 2014-04-18 20:33:08 +02:00
Antoine Pitrou c043061667 Try to fix buildbot failures on old OpenSSLs (< 1.0.0) - followup to issue #21015 2014-04-16 18:33:39 +02:00
Antoine Pitrou 94a5b663bf Issue #20896: ssl.get_server_certificate() now uses PROTOCOL_SSLv23, not PROTOCOL_SSLv3, for maximum compatibility. 2014-04-16 18:56:28 +02:00
Donald Stufft 6a2ba94908 Issue #21013: Enhance ssl.create_default_context() for server side contexts 
Closes #21013 by modfying ssl.create_default_context() to:

* Move the restricted ciphers to only apply when using
  ssl.Purpose.CLIENT_AUTH. The major difference between restricted and not
  is the lack of RC4 in the restricted. However there are servers that exist
  that only expose RC4 still.
* Switches the default protocol to ssl.PROTOCOL_SSLv23 so that the context
  will select TLS1.1 or TLS1.2 if it is available.
* Add ssl.OP_NO_SSLv3 by default to continue to block SSL3.0 sockets
* Add ssl.OP_SINGLE_DH_USE and ssl.OP_SINGLE_ECDG_USE to improve the security
  of the perfect forward secrecy
* Add ssl.OP_CIPHER_SERVER_PREFERENCE so that when used for a server side
  socket the context will prioritize our ciphers which have been carefully
  selected to maximize security and performance.
* Documents the failure conditions when a SSL3.0 connection is required so
  that end users can more easily determine if they need to unset
  ssl.OP_NO_SSLv3.
 2014-03-23 19:05:28 -04:00
Antoine Pitrou 0bebbc33fa Issue #21015: SSL contexts will now automatically select an elliptic curve for ECDH key exchange on OpenSSL 1.0.2 and later, and otherwise default to "prime256v1". 
(should also fix a buildbot failure introduced by #20995)
 2014-03-22 18:13:50 +01:00
Benjamin Peterson 10b93cc29c merge 3.3 (#20896) 2014-03-12 18:10:57 -05:00
Benjamin Peterson d0fc83d5eb merge 3.2 (#20896) 2014-03-12 18:10:47 -05:00
Benjamin Peterson cf25c5caae use ssl.PROTOCOL_SSLv23 for maximum compatibility (closes #20896) 2014-03-12 18:05:53 -05:00
Antoine Pitrou ba44860c11 Try to fix test_ssl failures on some buildbots 2014-01-09 21:30:17 +01:00
Antoine Pitrou 32c4915b23 Try to fix test_ssl failures on some buildbots 2014-01-09 21:28:48 +01:00
Antoine Pitrou 78ace81c93 Issue #20207: Always disable SSLv2 except when PROTOCOL_SSLv2 is explicitly asked for. 2014-01-09 20:09:03 +01:00
Antoine Pitrou cd3d7cabef Issue #20207: Always disable SSLv2 except when PROTOCOL_SSLv2 is explicitly asked for. 2014-01-09 20:02:20 +01:00
Antoine Pitrou 3e86ba4e32 Issue #19422: Explicitly disallow non-SOCK_STREAM sockets in the ssl module, rather than silently let them emit clear text data. 2013-12-28 17:26:33 +01:00
Antoine Pitrou e6d2f159fc Issue #19422: Explicitly disallow non-SOCK_STREAM sockets in the ssl module, rather than silently let them emit clear text data. 2013-12-28 17:30:51 +01:00
Victor Stinner 36e96b8716 (Merge 3.3) Issue #20025: ssl.RAND_bytes() and ssl.RAND_pseudo_bytes() now 
raise a ValueError if num is negative (instead of raising a SystemError).
 2013-12-19 16:47:25 +01:00
Victor Stinner 1e81a399a2 Issue #20025: ssl.RAND_bytes() and ssl.RAND_pseudo_bytes() now raise a 
ValueError if num is negative (instead of raising a SystemError).
 2013-12-19 16:47:04 +01:00
Christian Heimes bd9cbb0691 Issue #19919: Fix flacky SSL test. connect_ex() sometimes returns 
EWOULDBLOCK on Windows or VMs hosted on Windows.
 2013-12-16 21:16:45 +01:00
Christian Heimes de57074874 Issue #19919: Fix flacky SSL test. connect_ex() sometimes returns 
EWOULDBLOCK on Windows or VMs hosted on Windows.
 2013-12-16 21:15:44 +01:00
Christian Heimes 575596e19a test_ssl: skip tests when SNI is not available 2013-12-15 21:49:17 +01:00
Christian Heimes 8e7f394282 Test SSLSock's context getter and setter 2013-12-05 07:41:08 +01:00
Christian Heimes a02c69a73b add check_hostname arg to ssl._create_stdlib_context() 2013-12-02 20:59:28 +01:00
Christian Heimes 1aa9a75fbf Issue #19509: Add SSLContext.check_hostname to match the peer's certificate 
with server_hostname on handshake.
 2013-12-02 02:41:19 +01:00
Christian Heimes 67986f9431 Issue #19735: Implement private function ssl._create_stdlib_context() to 
create SSLContext objects in Python's stdlib module. It provides a single
configuration point and makes use of SSLContext.load_default_certs().
 2013-11-23 22:43:47 +01:00
Christian Heimes 4c05b472dd Issue #19689: Add ssl.create_default_context() factory function. It creates 
a new SSLContext object with secure default settings.
 2013-11-23 15:58:30 +01:00
Christian Heimes 72d28500b3 Issue #19292: Add SSLContext.load_default_certs() to load default root CA 
certificates from default stores or system stores. By default the method
loads CA certs for authentication of server certs.
 2013-11-23 13:56:58 +01:00
Christian Heimes 2427b50fdd Issue #8813: X509_VERIFY_PARAM is only available on OpenSSL 0.9.8+ 
The patch removes the verify_flags feature on Mac OS X 10.4 with OpenSSL 0.9.7l 28 Sep 2006.
 2013-11-23 11:24:32 +01:00
Christian Heimes 5398e1a56e Issue #19448: report name / NID in exception message of ASN1Object 2013-11-22 16:20:53 +01:00
Christian Heimes c2d65e1e93 Issue #17134: check certs of CA and ROOT system store 2013-11-22 16:13:55 +01:00
Christian Heimes 32f0c7a67b or VERIFY_CRL_CHECK_LEAF to verify_flags 2013-11-22 03:43:48 +01:00
Christian Heimes 44109d7de7 Issue #17134: Finalize interface to Windows' certificate store. Cert and 
CRL enumeration are now two functions. enum_certificates() also returns
purpose flags as set of OIDs.
 2013-11-22 01:51:30 +01:00
Christian Heimes d6dc952e17 one CERT_REQUIRED is enough 2013-11-22 00:39:38 +01:00
Christian Heimes 225877917e Issue #8813: Add SSLContext.verify_flags to change the verification flags 
of the context in order to enable certification revocation list (CRL)
checks or strict X509 rules.
 2013-11-21 23:56:13 +01:00
Christian Heimes bd3a7f90b5 Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP 
and CRL distribution points.
 2013-11-21 03:40:15 +01:00
Christian Heimes efff7060f8 Issue #18138: Implement cadata argument of SSLContext.load_verify_location() 
to load CA certificates and CRL from memory. It supports PEM and DER
encoded strings.
 2013-11-21 03:35:02 +01:00
Christian Heimes a6bc95aa02 Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. 2013-11-17 19:59:14 +01:00
Georg Brandl ec3c103520 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes 
inside subjectAltName correctly. Formerly the module has used OpenSSL's
GENERAL_NAME_print() function to get the string represention of ASN.1
strings for ``rfc822Name`` (email), ``dNSName`` (DNS) and
``uniformResourceIdentifier`` (URI).
 2014-09-30 14:04:51 +02:00
Georg Brandl 72c98d3a76 Issue #17997: Change behavior of ``ssl.match_hostname()`` to follow RFC 6125, 
for security reasons.  It now doesn't match multiple wildcards nor wildcards
inside IDN fragments.
 2013-10-27 07:16:53 +01:00
Georg Brandl b89b5df9c9 merge with 3.3 2013-10-27 07:46:09 +01:00
Antoine Pitrou 20b85557f2 Issue #19095: SSLSocket.getpeercert() now raises ValueError when the SSL handshake hasn't been done. 2013-09-29 19:50:53 +02:00
Christian Heimes 2769d44827 Issue #18709: Fix issue with IPv6 address in subjectAltName on Mac OS X Tiger 2013-08-25 14:12:50 +02:00
Christian Heimes 157c9834b4 Issue #18709: Fix issue with IPv6 address in subjectAltName on Mac OS X Tiger 2013-08-25 14:12:41 +02:00
Christian Heimes 6acbe2aaa3 Issue #18747: Re-seed OpenSSL's pseudo-random number generator after fork. 
A pthread_atfork() child handler is used to seeded the PRNG with pid, time
and some stack data.
 2013-08-21 13:26:34 +02:00
Christian Heimes f77b4b20e9 Issue #18747: Re-seed OpenSSL's pseudo-random number generator after fork. 
A pthread_atfork() child handler is used to seeded the PRNG with pid, time
and some stack data.
 2013-08-21 13:26:05 +02:00
Christian Heimes e06d47c70c Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes 
inside subjectAltName correctly. Formerly the module has used OpenSSL's
GENERAL_NAME_print() function to get the string represention of ASN.1
strings for rfc822Name (email), dNSName (DNS) and
uniformResourceIdentifier (URI).
 2013-08-17 00:58:00 +02:00
Christian Heimes 824f7f366d Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes 
inside subjectAltName correctly. Formerly the module has used OpenSSL's
GENERAL_NAME_print() function to get the string represention of ASN.1
strings for rfc822Name (email), dNSName (DNS) and
uniformResourceIdentifier (URI).
 2013-08-17 00:54:47 +02:00
Antoine Pitrou 2894073e1a test_ssl: use a bytestring here 2013-07-20 19:36:15 +02:00
Antoine Pitrou 60a26e0516 Issue #9177: Calling read() or write() now raises ValueError, not AttributeError, on a closed SSL socket. 
Patch by Senko Rasic.
 2013-07-20 19:35:16 +02:00
Christian Heimes 9a5395ae2b Issue #18147: Add diagnostic functions to ssl.SSLContext(). 
get_ca_list() lists all loaded CA certificates and cert_store_stats() returns
amount of loaded X.509 certs, X.509 CA certs and CRLs.
 2013-06-17 15:44:12 +02:00
Christian Heimes 9424bb4aea Issue #18207: Fix test_ssl for some versions of OpenSSL that ignore seconds 
in ASN1_TIME fields.
 2013-06-17 15:32:57 +02:00
Christian Heimes 46bebee25f Issue #17134: Add ssl.enum_cert_store() as interface to Windows' cert store. 2013-06-09 19:03:31 +02:00
Christian Heimes 6d7ad13a45 Issue #18143: Implement ssl.get_default_verify_paths() in order to debug 
the default locations for cafile and capath.
 2013-06-09 18:02:55 +02:00
Antoine Pitrou 86d53cadda Issue #17980: Fix possible abuse of ssl.match_hostname() for denial of service using certificates with many wildcards (CVE-2013-2099). 2013-05-18 17:56:42 +02:00
Antoine Pitrou 636f93c63b Issue #17980: Fix possible abuse of ssl.match_hostname() for denial of service using certificates with many wildcards (CVE-2013-2099). 2013-05-18 17:56:42 +02:00
Antoine Pitrou 31fb419908 Issue #17980: Fix possible abuse of ssl.match_hostname() for denial of service using certificates with many wildcards (CVE-2013-2099). 2013-05-18 17:59:12 +02:00
Antoine Pitrou 242db728e2 Issue #13721: SSLSocket.getpeercert() and SSLSocket.do_handshake() now raise an OSError with ENOTCONN, instead of an AttributeError, when the SSLSocket is not connected. 2013-05-01 20:52:07 +02:00
Antoine Pitrou 50b24d0d7c Fix a crash when setting a servername callback on a SSL server socket and the client doesn't send a server name. 
Patch by Kazuhiro Yoshida.
(originally issue #8109)
 2013-04-11 20:48:42 +02:00
Antoine Pitrou 609ef01b02 In search of TLS 1.1 bug: add debugging output in verbose mode 2013-03-29 18:09:06 +01:00
Antoine Pitrou 972d5bb763 Use a subtest in test_ssl.test_echo 2013-03-29 17:56:03 +01:00
Antoine Pitrou 2463e5fee4 Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. 2013-03-28 22:24:43 +01:00
Nadeem Vawda 6386e17f39 Issue #13898: test_ssl no longer prints a spurious stack trace on Ubuntu. 2013-03-03 22:48:15 +01:00
Nadeem Vawda ad246bfb71 Issue #13898: test_ssl no longer prints a spurious stack trace on Ubuntu. 2013-03-03 22:44:22 +01:00
Nadeem Vawda 7b39b9b51b Issue #13898: test_ssl no longer prints a spurious stack trace on Ubuntu. 2013-03-03 22:31:21 +01:00
Antoine Pitrou da23259f99 Issue #17107: Test client-side SNI support in urllib.request thanks to the new server-side SNI support in the ssl module. 
Initial patch by Daniel Black.
 2013-02-05 21:20:51 +01:00
Antoine Pitrou 6b4e2a9c02 In test_ssl, threaded tests shouldn't need the network resource to be enabled 2013-01-12 22:00:54 +01:00
Antoine Pitrou db5012ab47 In test_ssl, threaded tests shouldn't need the "network" resource to be enabled 2013-01-12 22:00:09 +01:00
Antoine Pitrou e9bb4733d9 Issue #16923: Fix ResourceWarnings in test_ssl. 2013-01-12 21:56:56 +01:00
Antoine Pitrou e1ceb50cdf Issue #16923: Fix ResourceWarnings in test_ssl. 2013-01-12 21:54:44 +01:00
Benjamin Peterson f86b3c394c merge 3.3 (#16900) 2013-01-10 14:16:42 -06:00
Benjamin Peterson 36f7b97787 remove __del__ because it's evil and also prevents the ResourceWarning on the socket from happening (closes #16900) 2013-01-10 14:16:20 -06:00
Antoine Pitrou 58ddc9d743 Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. 
Patch by Daniel Black.
 2013-01-05 21:20:29 +01:00
Antoine Pitrou 49f7e58778 Forward port new test for SSLSocket.connect_ex() 2012-12-28 19:09:41 +01:00
Antoine Pitrou 6464b84b3e Forward port new test for SSLSocket.connect_ex() 2012-12-28 19:08:49 +01:00
Antoine Pitrou ddb87ab1b4 Forward port new test for SSLSocket.connect_ex() 2012-12-28 19:07:43 +01:00
Antoine Pitrou 40f12ab0c5 Backport Python 3.2 fix for issue #12065, and add another test for SSLSocket.connect_ex(). 2012-12-28 19:03:43 +01:00
Andrew Svetlov f7a17b48d7 Replace IOError with OSError (#16715) 2012-12-25 16:47:37 +02:00
Andrew Svetlov 0832af6628 Issue #16717: get rid of socket.error, replace with OSError 2012-12-18 23:10:48 +02:00
Antoine Pitrou 73e9bd4d25 Issue #16357: fix calling accept() on a SSLSocket created through SSLContext.wrap_socket(). 
Original patch by Jeff McNeil.
 2012-11-11 01:27:33 +01:00
Antoine Pitrou 5c89b4ec55 Issue #16357: fix calling accept() on a SSLSocket created through SSLContext.wrap_socket(). 
Original patch by Jeff McNeil.
 2012-11-11 01:25:36 +01:00
Jesus Cea b7a2800831 MERGE: Closes #15793: Stack corruption in ssl.RAND_egd() 2012-09-11 02:08:48 +02:00
Jesus Cea c8754a13e6 Closes #15793: Stack corruption in ssl.RAND_egd() 2012-09-11 02:00:58 +02:00
Jesus Cea a8a5b397c1 Closes #15793: Stack corruption in ssl.RAND_egd(). Python 2.7 hasn't any issue about this, but add a test just to be sure 2012-09-11 01:55:04 +02:00
Antoine Pitrou 3b36fb1f53 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. 
The str() of a SSLError is also enhanced accordingly.

NOTE: this commit creates a reference leak.  The leak seems tied to the
use of PyType_FromSpec() to create the SSLError type.  The leak is on the
type object when it is instantiated:

>>> e = ssl.SSLError()
>>> sys.getrefcount(ssl.SSLError)
35
>>> e = ssl.SSLError()
>>> sys.getrefcount(ssl.SSLError)
36
>>> e = ssl.SSLError()
>>> sys.getrefcount(ssl.SSLError)
37
 2012-06-22 21:11:52 +02:00
Antoine Pitrou c642f67c63 Skip test_algorithms (known remote hosts need SNI, which is only available on 3.2+) 2012-05-04 16:33:30 +02:00
Antoine Pitrou f340c21ca9 Fix test connecting to sha256.tbs-internet.com. 
The certificate has changed and the test now needs SNI to pass.
 2012-05-04 16:26:56 +02:00
Antoine Pitrou 16f6f8338b Fix test connecting to sha256.tbs-internet.com. 
The certificate has changed and the test now needs SNI to pass.
 2012-05-04 16:26:02 +02:00
Antoine Pitrou d5d17eb653 Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. 
Patch by Colin Marc.
 2012-03-22 00:23:03 +01:00
Antoine Pitrou c135fa424e Fix last remaining build issues of _ssl under old OpenSSLs. Patch by Vinay. 2012-02-19 21:22:39 +01:00
Antoine Pitrou ce816a5111 Issue #13895: fix test_ssl hanging under Ubuntu 2012-01-28 17:40:23 +01:00
Antoine Pitrou eba63c4203 Issue #13895: fix test_ssl hanging under Ubuntu 2012-01-28 17:38:34 +01:00
Antoine Pitrou 6636887104 Fix intermittent test_ssl failure. 2012-01-27 17:34:56 +01:00
Antoine Pitrou eced82ecbf Fix intermittent test_ssl failure. 2012-01-27 17:33:01 +01:00
Antoine Pitrou 7a556846d4 Fix intermittent test_ssl failure. 2012-01-27 17:33:01 +01:00
Antoine Pitrou d76088d972 Issue #13636: Weak ciphers are now disabled by default in the ssl module 
(except when SSLv2 is explicitly asked for).
 2012-01-03 22:46:48 +01:00
Antoine Pitrou 8f85f907e3 Issue #13636: Weak ciphers are now disabled by default in the ssl module 
(except when SSLv2 is explicitly asked for).
 2012-01-03 22:46:48 +01:00
Antoine Pitrou 65a3f4b8c5 Use context managers in test_ssl to simplify test writing. 2011-12-21 16:52:40 +01:00
Antoine Pitrou 5b95eb90a7 Use context managers in test_ssl to simplify test writing. 2011-12-21 16:52:40 +01:00
Antoine Pitrou 72aeec35a1 Issue #13636: Weak ciphers are now disabled by default in the ssl module 
(except when SSLv2 is explicitly asked for).
 2012-01-03 22:49:08 +01:00
Antoine Pitrou 0e576f1f50 Issue #13626: Add support for SSL Diffie-Hellman key exchange, through the 
SSLContext.load_dh_params() method and the ssl.OP_SINGLE_DH_USE option.
 2011-12-22 10:03:38 +01:00
Antoine Pitrou 6b15c90fd8 Use context managers in test_ssl to simplify test writing. 2011-12-21 16:54:45 +01:00
Antoine Pitrou 501da61671 Fix ssl module compilation if ECDH support was disabled in the OpenSSL build. 
(followup to issue #13627)
 2011-12-21 09:27:41 +01:00
Antoine Pitrou 8691bff6db Fix for buggy test 2011-12-20 10:47:42 +01:00
Antoine Pitrou 8abdb8abd8 Issue #13634: Add support for querying and disabling SSL compression. 2011-12-20 10:13:40 +01:00
Antoine Pitrou 923df6f22a Issue #13627: Add support for SSL Elliptic Curve-based Diffie-Hellman 
key exchange, through the SSLContext.set_ecdh_curve() method and the
ssl.OP_SINGLE_ECDH_USE option.
 2011-12-19 17:16:51 +01:00
Antoine Pitrou 6db4944cc5 Issue #13635: Add ssl.OP_CIPHER_SERVER_PREFERENCE, so that SSL servers 
choose the cipher based on their own preferences, rather than on the
client's.
 2011-12-19 13:27:11 +01:00
Antoine Pitrou cf9943de97 Backout redundant changeset 1de4d92cd6a4 2011-10-31 20:23:00 +01:00
Barry Warsaw 39aec0171d test_protocol_sslv2(): Skip this test if ssl.PROTOCOL_SSLv2 is not 
defined (as is the case with Ubuntu 11.10).
 2011-10-31 14:08:15 -04:00
Antoine Pitrou 6361ea2b07 Remove unstable SSL tests in the absence of ssl.OP_NO_{SSLv2,SSLv3,TLSv1} 2011-10-30 21:31:34 +01:00
Barry Warsaw be83698f21 - Issue #13218: Fix test_ssl failures on Debian/Ubuntu. 2011-10-28 16:14:44 -04:00
Barry Warsaw c21a81bf76 - Issue #13218: Fix test_ssl failures on Debian/Ubuntu. 2011-10-28 17:08:12 -04:00
Barry Warsaw 46ae0efce1 - Issue #13218: Fix test_ssl failures on Debian/Ubuntu. 2011-10-28 16:52:17 -04:00
Antoine Pitrou 41032a69c1 Issue #11183: Add finer-grained exceptions to the ssl module, so that 
you don't have to inspect the exception's attributes in the common case.
 2011-10-27 23:56:55 +02:00
Antoine Pitrou f06eb46918 Issue #13034: When decoding some SSL certificates, the subjectAltName extension could be unreported. 2011-10-01 19:30:58 +02:00
Antoine Pitrou a02a12c517 Issue #13034: When decoding some SSL certificates, the subjectAltName extension could be unreported. 2011-10-01 19:22:30 +02:00
Antoine Pitrou d8c347a8de Issue #13034: When decoding some SSL certificates, the subjectAltName extension could be unreported. 2011-10-01 19:20:25 +02:00
Nick Coghlan 513886aabb Fix #12835: prevent use of the unencrypted sendmsg/recvmsg APIs on SSL wrapped sockets (Patch by David Watson) 2011-08-28 00:00:27 +10:00
Antoine Pitrou 4fd1e6a3ba Issue #12803: SSLContext.load_cert_chain() now accepts a password argument 
to be used if the private key is encrypted.  Patch by Adam Simpkins.
 2011-08-25 14:39:44 +02:00
Nick Coghlan 5fab03fd15 Remove the SSLSocket versions of sendmsg/recvmsg due to lack of proper tests and documentation in conjunction with lack of any known use cases (see issue #6560 for details) 2011-08-23 22:26:44 +10:00
Nick Coghlan 96fe56abec Add support for the send/recvmsg API to the socket module. Patch by David Watson and Heiko Wundram. (Closes #6560) 2011-08-22 11:55:57 +10:00