1cca273669
merge 3.4 ( #22417 )
2014-11-03 14:36:48 -05:00
4ffb075271
PEP 476: enable HTTPS certificate verification by default ( #22417 )
...
Patch by Alex Gaynor with some modifications by me.
2014-11-03 14:29:33 -05:00
1ed2e69a4a
Issue #22186 : Fix typos in Lib/.
...
Patch by Févry Thibault.
2014-10-19 18:07:05 +03:00
f23530f569
Issue #22186 : Fix typos in Lib/.
...
Patch by Févry Thibault.
2014-10-19 18:04:38 +03:00
a21de3d45e
Issue #22638 : SSLv3 is now disabled throughout the standard library.
...
It can still be enabled by instantiating a SSLContext manually.
2014-10-17 19:28:30 +02:00
e4eda4d33f
Issue #22638 : SSLv3 is now disabled throughout the standard library.
...
It can still be enabled by instantiating a SSLContext manually.
2014-10-17 19:28:30 +02:00
3cb9379881
Remove unused "block" argument in SSLObject.do_handshake() (issue #21965 )
2014-10-06 00:21:09 +02:00
b1fdf47ff5
Issue #21965 : Add support for in-memory SSL to the ssl module.
...
Patch by Geert Jansen.
2014-10-05 20:41:53 +02:00
8b9cfa1066
merge 3.4 ( #22449 )
2014-10-03 17:33:45 -04:00
5915b0f924
also use openssl envvars to find certs on windows ( closes #22449 )
...
Patch by Christian Heimes and Alex Gaynor.
2014-10-03 17:27:05 -04:00
47e40429fb
Issue #20421 : Add a .version() method to SSL sockets exposing the actual protocol version in use.
2014-09-04 21:00:10 +02:00
915d14190e
fix issue #17552 : add socket.sendfile() method allowing to send a file over a socket by using high-performance os.sendfile() on UNIX. Patch by Giampaolo Rodola'·
2014-06-11 03:54:30 +02:00
b4bebdafe3
Issue #20951 : SSLSocket.send() now raises either SSLWantReadError or SSLWantWriteError on a non-blocking socket if the operation would block. Previously, it would return 0.
...
Patch by Nikolaus Rath.
2014-04-29 10:03:28 +02:00
c695c95626
Issue #19940 : ssl.cert_time_to_seconds() now interprets the given time string in the UTC timezone (as specified in RFC 5280), not the local timezone.
...
Patch by Akira.
2014-04-28 20:57:36 +02:00
172f025bed
Issue #21068 : The ssl.PROTOCOL* constants are now enum members.
2014-04-18 20:33:08 +02:00
94a5b663bf
Issue #20896 : ssl.get_server_certificate() now uses PROTOCOL_SSLv23, not PROTOCOL_SSLv3, for maximum compatibility.
2014-04-16 18:56:28 +02:00
6a2ba94908
Issue #21013 : Enhance ssl.create_default_context() for server side contexts
...
Closes #21013 by modfying ssl.create_default_context() to:
* Move the restricted ciphers to only apply when using
ssl.Purpose.CLIENT_AUTH. The major difference between restricted and not
is the lack of RC4 in the restricted. However there are servers that exist
that only expose RC4 still.
* Switches the default protocol to ssl.PROTOCOL_SSLv23 so that the context
will select TLS1.1 or TLS1.2 if it is available.
* Add ssl.OP_NO_SSLv3 by default to continue to block SSL3.0 sockets
* Add ssl.OP_SINGLE_DH_USE and ssl.OP_SINGLE_ECDG_USE to improve the security
of the perfect forward secrecy
* Add ssl.OP_CIPHER_SERVER_PREFERENCE so that when used for a server side
socket the context will prioritize our ciphers which have been carefully
selected to maximize security and performance.
* Documents the failure conditions when a SSL3.0 connection is required so
that end users can more easily determine if they need to unset
ssl.OP_NO_SSLv3.
2014-03-23 19:05:28 -04:00
79ccaa2cad
Issue #20995 : Enhance default ciphers used by the ssl module
...
Closes #20995 by Enabling better security by prioritizing ciphers
such that:
* Prefer cipher suites that offer perfect forward secrecy (DHE/ECDHE)
* Prefer ECDHE over DHE for better performance
* Prefer any AES-GCM over any AES-CBC for better performance and security
* Then Use HIGH cipher suites as a fallback
* Then Use 3DES as fallback which is secure but slow
* Finally use RC4 as a fallback which is problematic but needed for
compatibility some times.
* Disable NULL authentication, NULL encryption, and MD5 MACs for security
reasons
2014-03-21 21:33:34 -04:00
7fa767e517
Issue #20976 : pyflakes: Remove unused imports
2014-03-20 09:16:38 +01:00
e6d2f159fc
Issue #19422 : Explicitly disallow non-SOCK_STREAM sockets in the ssl module, rather than silently let them emit clear text data.
2013-12-28 17:30:51 +01:00
3e86ba4e32
Issue #19422 : Explicitly disallow non-SOCK_STREAM sockets in the ssl module, rather than silently let them emit clear text data.
2013-12-28 17:26:33 +01:00
1da3ba8697
Issue #19509 : Don't close the socket in do_handshake() when hostname verification fails.
2013-12-04 20:46:20 +01:00
a02c69a73b
add check_hostname arg to ssl._create_stdlib_context()
2013-12-02 20:59:28 +01:00
1aa9a75fbf
Issue #19509 : Add SSLContext.check_hostname to match the peer's certificate
...
with server_hostname on handshake.
2013-12-02 02:41:19 +01:00
dec813f118
ssl.create_default_context() sets OP_NO_COMPRESSION to prevent CRIME
2013-11-28 08:06:54 +01:00
67986f9431
Issue #19735 : Implement private function ssl._create_stdlib_context() to
...
create SSLContext objects in Python's stdlib module. It provides a single
configuration point and makes use of SSLContext.load_default_certs().
2013-11-23 22:43:47 +01:00
4c05b472dd
Issue #19689 : Add ssl.create_default_context() factory function. It creates
...
a new SSLContext object with secure default settings.
2013-11-23 15:58:30 +01:00
72d28500b3
Issue #19292 : Add SSLContext.load_default_certs() to load default root CA
...
certificates from default stores or system stores. By default the method
loads CA certs for authentication of server certs.
2013-11-23 13:56:58 +01:00
44109d7de7
Issue #17134 : Finalize interface to Windows' certificate store. Cert and
...
CRL enumeration are now two functions. enum_certificates() also returns
purpose flags as set of OIDs.
2013-11-22 01:51:30 +01:00
225877917e
Issue #8813 : Add SSLContext.verify_flags to change the verification flags
...
of the context in order to enable certification revocation list (CRL)
checks or strict X509 rules.
2013-11-21 23:56:13 +01:00
a6bc95aa02
Issue #19448 : Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name.
2013-11-17 19:59:14 +01:00
72c98d3a76
Issue #17997 : Change behavior of ``ssl.match_hostname()`` to follow RFC 6125,
...
for security reasons. It now doesn't match multiple wildcards nor wildcards
inside IDN fragments.
2013-10-27 07:16:53 +01:00
b89b5df9c9
merge with 3.3
2013-10-27 07:46:09 +01:00
9a3777e525
#18705 : merge with 3.3.
2013-08-17 15:53:55 +03:00
30b9d5d3af
#18705 : fix a number of typos. Patch by Févry Thibault.
2013-08-17 15:50:46 +03:00
60a26e0516
Issue #9177 : Calling read() or write() now raises ValueError, not AttributeError, on a closed SSL socket.
...
Patch by Senko Rasic.
2013-07-20 19:35:16 +02:00
cd171c8e92
Issue #18200 : Back out usage of ModuleNotFoundError (8d28d44f3a9a)
2013-07-04 17:43:24 -04:00
0a140668fa
Issue #18200 : Update the stdlib (except tests) to use
...
ModuleNotFoundError.
2013-06-13 20:57:26 -04:00
46bebee25f
Issue #17134 : Add ssl.enum_cert_store() as interface to Windows' cert store.
2013-06-09 19:03:31 +02:00
6d7ad13a45
Issue #18143 : Implement ssl.get_default_verify_paths() in order to debug
...
the default locations for cafile and capath.
2013-06-09 18:02:55 +02:00
636f93c63b
Issue #17980 : Fix possible abuse of ssl.match_hostname() for denial of service using certificates with many wildcards (CVE-2013-2099).
2013-05-18 17:56:42 +02:00
31fb419908
Issue #17980 : Fix possible abuse of ssl.match_hostname() for denial of service using certificates with many wildcards (CVE-2013-2099).
2013-05-18 17:59:12 +02:00
242db728e2
Issue #13721 : SSLSocket.getpeercert() and SSLSocket.do_handshake() now raise an OSError with ENOTCONN, instead of an AttributeError, when the SSLSocket is not connected.
2013-05-01 20:52:07 +02:00
06d0c1e72c
remove uneffective 'while True' clause
2013-04-03 12:01:44 +02:00
2463e5fee4
Issue #16692 : The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù.
2013-03-28 22:24:43 +01:00
f86b3c394c
merge 3.3 ( #16900 )
2013-01-10 14:16:42 -06:00
36f7b97787
remove __del__ because it's evil and also prevents the ResourceWarning on the socket from happening ( closes #16900 )
2013-01-10 14:16:20 -06:00
58ddc9d743
Issue #8109 : The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method.
...
Patch by Daniel Black.
2013-01-05 21:20:29 +01:00
0832af6628
Issue #16717 : get rid of socket.error, replace with OSError
2012-12-18 23:10:48 +02:00
73e9bd4d25
Issue #16357 : fix calling accept() on a SSLSocket created through SSLContext.wrap_socket().
...
Original patch by Jeff McNeil.
2012-11-11 01:27:33 +01:00
5c89b4ec55
Issue #16357 : fix calling accept() on a SSLSocket created through SSLContext.wrap_socket().
...
Original patch by Jeff McNeil.
2012-11-11 01:25:36 +01:00
d5d17eb653
Issue #14204 : The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library.
...
Patch by Colin Marc.
2012-03-22 00:23:03 +01:00
a9bf2ac726
Try to really fix compilation failures of the _ssl module under very old OpenSSLs.
2012-02-17 18:47:54 +01:00
8f85f907e3
Issue #13636 : Weak ciphers are now disabled by default in the ssl module
...
(except when SSLv2 is explicitly asked for).
2012-01-03 22:46:48 +01:00
72aeec35a1
Issue #13636 : Weak ciphers are now disabled by default in the ssl module
...
(except when SSLv2 is explicitly asked for).
2012-01-03 22:49:08 +01:00
0e576f1f50
Issue #13626 : Add support for SSL Diffie-Hellman key exchange, through the
...
SSLContext.load_dh_params() method and the ssl.OP_SINGLE_DH_USE option.
2011-12-22 10:03:38 +01:00
501da61671
Fix ssl module compilation if ECDH support was disabled in the OpenSSL build.
...
(followup to issue #13627 )
2011-12-21 09:27:41 +01:00
8abdb8abd8
Issue #13634 : Add support for querying and disabling SSL compression.
2011-12-20 10:13:40 +01:00
923df6f22a
Issue #13627 : Add support for SSL Elliptic Curve-based Diffie-Hellman
...
key exchange, through the SSLContext.set_ecdh_curve() method and the
ssl.OP_SINGLE_ECDH_USE option.
2011-12-19 17:16:51 +01:00
6db4944cc5
Issue #13635 : Add ssl.OP_CIPHER_SERVER_PREFERENCE, so that SSL servers
...
choose the cipher based on their own preferences, rather than on the
client's.
2011-12-19 13:27:11 +01:00
41032a69c1
Issue #11183 : Add finer-grained exceptions to the ssl module, so that
...
you don't have to inspect the exception's attributes in the common case.
2011-10-27 23:56:55 +02:00
513886aabb
Fix #12835 : prevent use of the unencrypted sendmsg/recvmsg APIs on SSL wrapped sockets (Patch by David Watson)
2011-08-28 00:00:27 +10:00
5fab03fd15
Remove the SSLSocket versions of sendmsg/recvmsg due to lack of proper tests and documentation in conjunction with lack of any known use cases (see issue #6560 for details)
2011-08-23 22:26:44 +10:00
96fe56abec
Add support for the send/recvmsg API to the socket module. Patch by David Watson and Heiko Wundram. ( Closes #6560 )
2011-08-22 11:55:57 +10:00
d649480739
Issue #12551 : Provide a get_channel_binding() method on SSL sockets so as
...
to get channel binding data for the current SSL session (only the
"tls-unique" channel binding is implemented). This allows the
implementation of certain authentication mechanisms such as SCRAM-SHA-1-PLUS.
Patch by Jacek Konieczny.
2011-07-21 01:11:30 +02:00
7128f95bd2
Issue #12440 : When testing whether some bits in SSLContext.options can be
...
reset, check the version of the OpenSSL headers Python was compiled against,
rather than the runtime version of the OpenSSL library.
2011-07-08 18:49:07 +02:00
b9ac25d1c3
Issue #12440 : When testing whether some bits in SSLContext.options can be
...
reset, check the version of the OpenSSL headers Python was compiled against,
rather than the runtime version of the OpenSSL library.
2011-07-08 18:47:06 +02:00
99c8b16143
Issue #12049 : Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl
...
module.
2011-05-24 12:05:19 +02:00
7a616f2fc5
Issue #12065 : connect_ex() on an SSL socket now returns the original errno
...
when the socket's timeout expires (it used to return None).
2011-05-18 18:52:20 +02:00
b4410dbea6
Issue #12065 : connect_ex() on an SSL socket now returns the original errno
...
when the socket's timeout expires (it used to return None).
2011-05-18 18:51:06 +02:00
17ca323e7c
(Merge 3.1) Issue #12012 : ssl.PROTOCOL_SSLv2 becomes optional
...
OpenSSL is now compiled with OPENSSL_NO_SSL2 defined (without the SSLv2
protocol) on Debian: fix the ssl module on Debian Testing and Debian Sid.
Optimize also ssl.get_protocol_name(): speed does matter!
2011-05-10 00:48:41 +02:00
ee18b6f2fd
Issue #12012 : ssl.PROTOCOL_SSLv2 becomes optional
...
OpenSSL is now compiled with OPENSSL_NO_SSL2 defined (without the SSLv2
protocol) on Debian: fix the ssl module on Debian Testing and Debian Sid.
Optimize also ssl.get_protocol_name(): speed does matter!
2011-05-10 00:38:00 +02:00
3de49192aa
Issue #12012 : ssl.PROTOCOL_SSLv2 becomes optional
...
OpenSSL is now compiled with OPENSSL_NO_SSL2 defined (without the SSLv2
protocol) on Debian: fix the ssl module on Debian Testing and Debian Sid.
Optimize also ssl.get_protocol_name(): speed does matter!
2011-05-09 00:42:58 +02:00
ff9bfca482
Issue #12000 : When a SSL certificate has a subjectAltName without any
...
dNSName entry, ssl.match_hostname() should use the subject's commonName.
Patch by Nicolas Bareil.
2011-05-06 15:20:55 +02:00
1c86b44506
Issue #12000 : When a SSL certificate has a subjectAltName without any
...
dNSName entry, ssl.match_hostname() should use the subject's commonName.
Patch by Nicolas Bareil.
2011-05-06 15:19:49 +02:00
15399c3f09
Issue #11811 : ssl.get_server_certificate() is now IPv6-compatible. Patch
...
by Charles-François Natali.
2011-04-28 19:23:55 +02:00
86cbfec50a
Merged revisions 88664 via svnmerge from
...
svn+ssh://pythondev@svn.python.org/python/branches/py3k
........
r88664 | antoine.pitrou | 2011-02-27 00:24:06 +0100 (dim., 27 févr. 2011) | 4 lines
Issue #11326 : Add the missing connect_ex() implementation for SSL sockets,
and make it work for non-blocking connects.
........
2011-02-26 23:25:34 +00:00
e93bf7aed2
Issue #11326 : Add the missing connect_ex() implementation for SSL sockets,
...
and make it work for non-blocking connects.
2011-02-26 23:24:06 +00:00
d532321f7b
Issue #5639 : Add a *server_hostname* argument to `SSLContext.wrap_socket`
...
in order to support the TLS SNI extension. `HTTPSConnection` and
`urlopen()` also use this argument, so that HTTPS virtual hosts are now
supported.
2010-10-22 18:19:07 +00:00
59fdd6736b
Issue #1589 : Add ssl.match_hostname(), to help implement server identity
...
verification for higher-level protocols.
2010-10-08 10:37:08 +00:00
5974cdd5f5
Merged revisions 84807 via svnmerge from
...
svn+ssh://pythondev@svn.python.org/python/branches/py3k
........
r84807 | antoine.pitrou | 2010-09-14 16:43:44 +0200 (mar., 14 sept. 2010) | 4 lines
Issue #9853 : Fix the signature of SSLSocket.recvfrom() and
SSLSocket.sendto() to match the corresponding socket methods.
........
2010-09-14 14:47:08 +00:00
a468adc76d
Issue #9853 : Fix the signature of SSLSocket.recvfrom() and
...
SSLSocket.sendto() to match the corresponding socket methods.
2010-09-14 14:43:44 +00:00
10c4c23a25
Merged revisions 84464 via svnmerge from
...
svn+ssh://pythondev@svn.python.org/python/branches/py3k
........
r84464 | antoine.pitrou | 2010-09-03 20:38:17 +0200 (ven., 03 sept. 2010) | 3 lines
Issue #3805 : clean up implementation of the _read method in _ssl.c.
........
2010-09-03 18:39:47 +00:00
24e561ae04
Issue #3805 : clean up implementation of the _read method in _ssl.c.
2010-09-03 18:38:17 +00:00
8b7da623ce
Fix issue #9711 : raise ValueError is SSLConnection constructor is invoked with keyfile and not certfile.
2010-08-30 18:28:05 +00:00
745ab3807e
Fix issue issue9706: provides a better error handling for various SSL operations
2010-08-29 19:25:49 +00:00
374f835316
Raise ValuError if non-zero flag argument is provided for sendall() method for conformity with send(), recv() and recv_into()
2010-08-29 12:08:09 +00:00
6e451df800
Followup to r83869 and issue #8524 : rename socket.forget() to socket.detach()
...
and make it return the file descriptor.
2010-08-09 20:39:54 +00:00
e43f9d0ed6
Issue #8524 : Add a forget() method to socket objects, so as to put the
...
socket into the closed state without closing the underlying file
descriptor.
2010-08-08 23:24:50 +00:00
b52187710e
Issue #4870 : Add an `options` attribute to SSL contexts, as well as
...
several ``OP_*`` constants to the `ssl` module. This allows to selectively
disable protocol versions, when used in combination with `PROTOCOL_SSLv23`.
2010-05-21 09:56:06 +00:00
152efa2ae2
Issue #8550 : Add first class `SSLContext` objects to the ssl module.
2010-05-16 18:19:27 +00:00
f07d5589c0
Merged revisions 80517 via svnmerge from
...
svn+ssh://pythondev@svn.python.org/python/branches/py3k
........
r80517 | antoine.pitrou | 2010-04-27 01:06:26 +0200 (mar., 27 avril 2010) | 3 lines
Remove unused import
........
2010-04-26 23:08:35 +00:00
90e6d04071
Remove unused import
2010-04-26 23:06:26 +00:00
28f7ab6402
Merged revisions 80515 via svnmerge from
...
svn+ssh://pythondev@svn.python.org/python/branches/py3k
........
r80515 | antoine.pitrou | 2010-04-27 00:17:47 +0200 (mar., 27 avril 2010) | 4 lines
Hopefully fix sporadic Windows issue by avoiding calling getpeername()
on a freshly dup'ed socket.
........
2010-04-26 22:37:59 +00:00
fa2b9380c0
Hopefully fix sporadic Windows issue by avoiding calling getpeername()
...
on a freshly dup'ed socket.
2010-04-26 22:17:47 +00:00
365171d8f6
Merged revisions 80509 via svnmerge from
...
svn+ssh://pythondev@svn.python.org/python/branches/py3k
................
r80509 | antoine.pitrou | 2010-04-26 19:29:05 +0200 (lun., 26 avril 2010) | 10 lines
Merged revisions 80507 via svnmerge from
svn+ssh://pythondev@svn.python.org/python/trunk
........
r80507 | antoine.pitrou | 2010-04-26 19:23:33 +0200 (lun., 26 avril 2010) | 4 lines
When calling getpeername() in SSLSocket.__init__, only silence exceptions
caused by the "socket not connected" condition.
........
................
2010-04-26 17:32:49 +00:00
de8cf32ec8
Merged revisions 80507 via svnmerge from
...
svn+ssh://pythondev@svn.python.org/python/trunk
........
r80507 | antoine.pitrou | 2010-04-26 19:23:33 +0200 (lun., 26 avril 2010) | 4 lines
When calling getpeername() in SSLSocket.__init__, only silence exceptions
caused by the "socket not connected" condition.
........
2010-04-26 17:29:05 +00:00
c2203f92ff
Merged revisions 80456 via svnmerge from
...
svn+ssh://pythondev@svn.python.org/python/branches/py3k
........
r80456 | antoine.pitrou | 2010-04-25 00:04:40 +0200 (dim., 25 avril 2010) | 5 lines
Issue #8524 : When creating an SSL socket, the timeout value of the
original socket wasn't retained (instead, a socket with a positive timeout
would be turned into a non-blocking SSL socket).
........
2010-04-24 22:07:51 +00:00
40f0874b55
Issue #8524 : When creating an SSL socket, the timeout value of the
...
original socket wasn't retained (instead, a socket with a positive timeout
would be turned into a non-blocking SSL socket).
2010-04-24 22:04:40 +00:00
2d9cb9c1cb
Merged revisions 80151 via svnmerge from
...
svn+ssh://pythondev@svn.python.org/python/trunk
........
r80151 | antoine.pitrou | 2010-04-17 19:10:38 +0200 (sam., 17 avril 2010) | 4 lines
Issue #8322 : Add a *ciphers* argument to SSL sockets, so as to change the
available cipher list. Helps fix test_ssl with OpenSSL 1.0.0.
........
2010-04-17 17:40:45 +00:00
Benjamin Peterson
Berker Peksag
Antoine Pitrou
Giampaolo Rodola'
Donald Stufft
Victor Stinner
Christian Heimes
Georg Brandl
Ezio Melotti
Brett Cannon
Andrew Svetlov
Nick Coghlan
Victor Stinner