990fcaac3c
expose X509_V_FLAG_TRUSTED_FIRST
2015-03-04 22:49:41 -05:00
c481bfb3f6
Issue #23239 : ssl.match_hostname() now supports matching of IP addresses.
2015-02-15 18:12:20 +01:00
8861502e07
prefer server alpn ordering over the client's
2015-01-23 17:30:26 -05:00
cca2732a82
add support for ALPN ( closes #20188 )
2015-01-23 16:35:37 -05:00
4cb17812d9
expose the client's cipher suites from the handshake ( closes #23186 )
2015-01-07 11:14:26 -06:00
3ce67a9560
Issue #23177 : Document that ssl.RAND_egd() is not available with LibreSSL
2015-01-06 13:53:09 +01:00
b92fd01189
note that sslv3 may not be available
2014-12-06 11:36:32 -05:00
b757c83ec6
Issue #22581 : Use more "bytes-like object" throughout the docs and comments.
2014-12-05 22:25:22 +02:00
2b207badd6
Fix #22987 : update the compatibility matrix for a SSLv23 client.
2014-12-03 20:00:56 +01:00
dbd4bcfcca
correct versionchanged version
2014-11-23 20:09:31 -06:00
7243b574e5
don't require OpenSSL SNI to pass hostname to ssl functions ( #22921 )
...
Patch by Donald Stufft.
2014-11-23 17:04:34 -06:00
b9859daeeb
merge 3.4
2014-12-06 11:37:18 -05:00
92bf919ed0
Issue #22581 : Use more "bytes-like object" throughout the docs and comments.
2014-12-05 22:26:10 +02:00
af12676659
Fix #22987 : update the compatibility matrix for a SSLv23 client.
2014-12-03 20:03:11 +01:00
f9284ae8ed
merge 3.4 ( #22921 )
2014-11-23 17:06:39 -06:00
bad8d4bb53
merge with 3.4
2014-10-29 10:57:42 +01:00
b7354a65ce
Fixing broken links in doc, part 4: some more breaks and redirects
2014-10-29 10:57:37 +01:00
35cd53a940
Issue #22660 : update various mentions in the ssl module documentation.
2014-10-21 00:16:00 +02:00
4b4ddb2190
Issue #22660 : update various mentions in the ssl module documentation.
2014-10-21 00:14:39 +02:00
2debf15593
Issue #22564 : cleanup SSLObject doc
2014-10-10 13:04:08 +02:00
29611452b7
Issue #22564 : ssl doc, add more links to the non-blocking section
2014-10-10 12:52:43 +02:00
805b262d38
Issue #22564 : ssl doc: reorganize and reindent documentation of SSLObject and
...
MemoryBIO; move documentation of SSLContext.wrap_bio()
2014-10-10 12:49:08 +02:00
9558e90315
Merge 3.4
2014-10-10 12:47:01 +02:00
cfb2a0a855
Issue #22564 : ssl doc: mention asyncio in the non-blocking section
2014-10-10 12:45:10 +02:00
92127a5edb
Merge 3.4
2014-10-10 12:43:17 +02:00
d28fe8c8f4
Issue #22564 : ssl doc: mention how SSLSocket are usually created
2014-10-10 12:07:19 +02:00
3c3d3c73f3
Issue #22564 : ssl doc: use "class" marker to document the SSLSocket class
2014-10-10 12:06:51 +02:00
41f92c2818
Issue #22564 : ssl doc: document read(), write(), pending, server_side and
...
server_hostname methods and attributes of SSLSocket.
2014-10-10 12:05:56 +02:00
851a6cc071
Issue #22564 : ssl doc: fix typos
2014-10-10 12:04:15 +02:00
b1fdf47ff5
Issue #21965 : Add support for in-memory SSL to the ssl module.
...
Patch by Geert Jansen.
2014-10-05 20:41:53 +02:00
131caba074
Revert #22251
2014-09-28 00:01:55 +03:00
9c1dba2758
Revert #22251
2014-09-28 00:00:58 +03:00
f7fee33104
Issue #22251 : Fix ReST markup to avoid errors building docs.
2014-09-27 23:22:35 +03:00
3749404ba5
Issue #22251 : Fix ReST markup to avoid errors building docs.
2014-09-27 23:21:35 +03:00
47e40429fb
Issue #20421 : Add a .version() method to SSL sockets exposing the actual protocol version in use.
2014-09-04 21:00:10 +02:00
b27d3a2d21
Closes #22072 : Merge typo fixes from 3.4
2014-07-25 13:31:36 -05:00
88a1977a08
Issue #22072 : Fix a couple of SSL doc typos. Patch by Alex Gaynor.
2014-07-25 13:30:50 -05:00
68f411670e
Issue #21994 : Merge with 3.4.
2014-07-17 05:02:02 +03:00
38bf87c7f2
Issue #21994 : Fix SyntaxError in the SSLContext.check_hostname documentation.
2014-07-17 05:00:36 +03:00
ba9fb0d83f
Fix doc build warning
2014-06-11 15:02:25 -05:00
915d14190e
fix issue #17552 : add socket.sendfile() method allowing to send a file over a socket by using high-performance os.sendfile() on UNIX. Patch by Giampaolo Rodola'·
2014-06-11 03:54:30 +02:00
8b852f111e
Fix Issue #21528 - Fix documentation typos
2014-05-20 12:58:38 -04:00
f48ff0dd6c
Issue #21430 : additions to the description of non-blocking SSL sockets
2014-05-18 00:56:53 +02:00
75e03388d8
Issue #21430 : additions to the description of non-blocking SSL sockets
2014-05-18 00:55:13 +02:00
b4bebdafe3
Issue #20951 : SSLSocket.send() now raises either SSLWantReadError or SSLWantWriteError on a non-blocking socket if the operation would block. Previously, it would return 0.
...
Patch by Nikolaus Rath.
2014-04-29 10:03:28 +02:00
c695c95626
Issue #19940 : ssl.cert_time_to_seconds() now interprets the given time string in the UTC timezone (as specified in RFC 5280), not the local timezone.
...
Patch by Akira.
2014-04-28 20:57:36 +02:00
94a5b663bf
Issue #20896 : ssl.get_server_certificate() now uses PROTOCOL_SSLv23, not PROTOCOL_SSLv3, for maximum compatibility.
2014-04-16 18:56:28 +02:00
4137465bf5
Issue #21043 : Remove the recommendation for specific CA organizations
...
Closes #21043 by updating the documentation to remove specific CA
organizations and update the text to no longer need to tell you to
download root certificates, but instead use the OS certificates
avaialble through SSLContext.load_default_certs.
2014-03-24 19:26:03 -04:00
6a2ba94908
Issue #21013 : Enhance ssl.create_default_context() for server side contexts
...
Closes #21013 by modfying ssl.create_default_context() to:
* Move the restricted ciphers to only apply when using
ssl.Purpose.CLIENT_AUTH. The major difference between restricted and not
is the lack of RC4 in the restricted. However there are servers that exist
that only expose RC4 still.
* Switches the default protocol to ssl.PROTOCOL_SSLv23 so that the context
will select TLS1.1 or TLS1.2 if it is available.
* Add ssl.OP_NO_SSLv3 by default to continue to block SSL3.0 sockets
* Add ssl.OP_SINGLE_DH_USE and ssl.OP_SINGLE_ECDG_USE to improve the security
of the perfect forward secrecy
* Add ssl.OP_CIPHER_SERVER_PREFERENCE so that when used for a server side
socket the context will prioritize our ciphers which have been carefully
selected to maximize security and performance.
* Documents the failure conditions when a SSL3.0 connection is required so
that end users can more easily determine if they need to unset
ssl.OP_NO_SSLv3.
2014-03-23 19:05:28 -04:00
f8cbbbb652
Issue #20913 : make it clear that create_default_context() also enables hostname checking
2014-03-23 16:31:08 +01:00
c5e075ff03
Issue #20913 : improve the SSL security considerations to first advocate using create_default_context().
2014-03-22 18:19:11 +01:00
79ccaa2cad
Issue #20995 : Enhance default ciphers used by the ssl module
...
Closes #20995 by Enabling better security by prioritizing ciphers
such that:
* Prefer cipher suites that offer perfect forward secrecy (DHE/ECDHE)
* Prefer ECDHE over DHE for better performance
* Prefer any AES-GCM over any AES-CBC for better performance and security
* Then Use HIGH cipher suites as a fallback
* Then Use 3DES as fallback which is secure but slow
* Finally use RC4 as a fallback which is problematic but needed for
compatibility some times.
* Disable NULL authentication, NULL encryption, and MD5 MACs for security
reasons
2014-03-21 21:33:34 -04:00
3732ed2414
Merge in all documentation changes since branching 3.4.0rc1.
2014-03-15 21:13:56 -07:00
e6d2f159fc
Issue #19422 : Explicitly disallow non-SOCK_STREAM sockets in the ssl module, rather than silently let them emit clear text data.
2013-12-28 17:30:51 +01:00
3e86ba4e32
Issue #19422 : Explicitly disallow non-SOCK_STREAM sockets in the ssl module, rather than silently let them emit clear text data.
2013-12-28 17:26:33 +01:00
748bad2cd0
Tidy up ssl whatsnew references, make ssl section formatting consistent.
...
Also remove some extra blank lines in the ssl doc acctions for tls1.1/1.2,
and reflow a paragraph.
2013-12-20 17:08:39 -05:00
1aa9a75fbf
Issue #19509 : Add SSLContext.check_hostname to match the peer's certificate
...
with server_hostname on handshake.
2013-12-02 02:41:19 +01:00
0e90e99188
Issue #19795 : Improved markup of True/False constants.
2013-11-29 12:19:53 +02:00
fbc1c26803
Issue #19795 : Improved markup of True/False constants.
2013-11-29 12:17:13 +02:00
5bef410471
Tweak ssl docs
2013-11-23 16:16:29 +01:00
4c05b472dd
Issue #19689 : Add ssl.create_default_context() factory function. It creates
...
a new SSLContext object with secure default settings.
2013-11-23 15:58:30 +01:00
6b2ff98df4
Correct documentation clientAuth -> CLIENT_AUTH
2013-11-23 14:42:01 +01:00
72d28500b3
Issue #19292 : Add SSLContext.load_default_certs() to load default root CA
...
certificates from default stores or system stores. By default the method
loads CA certs for authentication of server certs.
2013-11-23 13:56:58 +01:00
2427b50fdd
Issue #8813 : X509_VERIFY_PARAM is only available on OpenSSL 0.9.8+
...
The patch removes the verify_flags feature on Mac OS X 10.4 with OpenSSL 0.9.7l 28 Sep 2006.
2013-11-23 11:24:32 +01:00
f22e8e5426
Issue #18147 : Add missing documentation for SSLContext.get_ca_certs().
...
Also change the argument name to the same name as getpeercert()
2013-11-22 02:22:51 +01:00
44109d7de7
Issue #17134 : Finalize interface to Windows' certificate store. Cert and
...
CRL enumeration are now two functions. enum_certificates() also returns
purpose flags as set of OIDs.
2013-11-22 01:51:30 +01:00
225877917e
Issue #8813 : Add SSLContext.verify_flags to change the verification flags
...
of the context in order to enable certification revocation list (CRL)
checks or strict X509 rules.
2013-11-21 23:56:13 +01:00
bd3a7f90b5
Issue #18379 : SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP
...
and CRL distribution points.
2013-11-21 03:40:15 +01:00
efff7060f8
Issue #18138 : Implement cadata argument of SSLContext.load_verify_location()
...
to load CA certificates and CRL from memory. It supports PEM and DER
encoded strings.
2013-11-21 03:35:02 +01:00
6b2b084192
Issue #19508 : direct the user to read the security considerations for the ssl module
2013-11-17 15:36:03 +01:00
9eefe91fc2
Issue #19508 : direct the user to read the security considerations for the ssl module
2013-11-17 15:35:33 +01:00
9f09120b83
merge
2013-10-29 22:21:16 +01:00
47674bc470
fix language
2013-10-29 22:19:39 +01:00
ee0bac66b2
Issue #19227 / Issue #18747 : Remove pthread_atfork() handler to remove OpenSSL re-seeding
...
It is causing trouble like e.g. hanging processes.
2013-10-29 21:11:55 +01:00
3046fe4c03
Issue #18747 : document issue with OpenSSL's CPRNG state and fork
2013-10-29 21:08:56 +01:00
72c98d3a76
Issue #17997 : Change behavior of ``ssl.match_hostname()`` to follow RFC 6125,
...
for security reasons. It now doesn't match multiple wildcards nor wildcards
inside IDN fragments.
2013-10-27 07:16:53 +01:00
b89b5df9c9
merge with 3.3
2013-10-27 07:46:09 +01:00
99b1a12f2f
merge with 3.3
2013-10-06 18:20:39 +02:00
4a6cf6c9d1
Closes #19177 : replace dead link to SSL/TLS introduction with the version from Apache.
2013-10-06 18:20:31 +02:00
20b85557f2
Issue #19095 : SSLSocket.getpeercert() now raises ValueError when the SSL handshake hasn't been done.
2013-09-29 19:50:53 +02:00
d36fc4307e
Fix minor documentation markup error.
2013-08-03 02:49:53 -07:00
fe3ae3cdc7
Merge #18311 : fix typo.
2013-06-26 15:11:32 -04:00
c7f7579855
#18311 : fix typo.
2013-06-26 15:11:12 -04:00
9a5395ae2b
Issue #18147 : Add diagnostic functions to ssl.SSLContext().
...
get_ca_list() lists all loaded CA certificates and cert_store_stats() returns
amount of loaded X.509 certs, X.509 CA certs and CRLs.
2013-06-17 15:44:12 +02:00
46bebee25f
Issue #17134 : Add ssl.enum_cert_store() as interface to Windows' cert store.
2013-06-09 19:03:31 +02:00
3e738f97f8
removed accidental new line
2013-06-09 18:07:16 +02:00
6d7ad13a45
Issue #18143 : Implement ssl.get_default_verify_paths() in order to debug
...
the default locations for cafile and capath.
2013-06-09 18:02:55 +02:00
9b42128e2c
Issue #17739 : fix the description of SSLSocket.getpeercert(binary_form=True) for server sockets.
...
Thanks to David D Lowe for reporting.
2013-04-16 20:28:15 +02:00
d34941ad4e
Issue #17739 : fix the description of SSLSocket.getpeercert(binary_form=True) for server sockets.
...
Thanks to David D Lowe for reporting.
2013-04-16 20:27:17 +02:00
50b24d0d7c
Fix a crash when setting a servername callback on a SSL server socket and the client doesn't send a server name.
...
Patch by Kazuhiro Yoshida.
(originally issue #8109 )
2013-04-11 20:48:42 +02:00
2463e5fee4
Issue #16692 : The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù.
2013-03-28 22:24:43 +01:00
8e7586bd44
Issue #17047 : remove doubled words added in 3.4,
...
as reported by Serhiy Storchaka and Matthew Barnett.
2013-03-11 18:38:13 -04:00
58ddc9d743
Issue #8109 : The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method.
...
Patch by Daniel Black.
2013-01-05 21:20:29 +01:00
d9a7e70939
Update the getpeercert() example with a real-world cert showing non-trivial issuer, subject and subjectAltName.
2012-08-16 22:18:37 +02:00
b7c6c8105e
Update the getpeercert() example with a real-world cert showing non-trivial issuer, subject and subjectAltName.
2012-08-16 22:14:43 +02:00
3b36fb1f53
Issue #14837 : SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule.
...
The str() of a SSLError is also enhanced accordingly.
NOTE: this commit creates a reference leak. The leak seems tied to the
use of PyType_FromSpec() to create the SSLError type. The leak is on the
type object when it is instantiated:
>>> e = ssl.SSLError()
>>> sys.getrefcount(ssl.SSLError)
35
>>> e = ssl.SSLError()
>>> sys.getrefcount(ssl.SSLError)
36
>>> e = ssl.SSLError()
>>> sys.getrefcount(ssl.SSLError)
37
2012-06-22 21:11:52 +02:00
d5d17eb653
Issue #14204 : The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library.
...
Patch by Colin Marc.
2012-03-22 00:23:03 +01:00
e10ae8871a
Clarify that ssl.OP_ALL can be different from OpenSSL's SSL_OP_ALL.
2012-01-27 10:03:23 +01:00
9f6b02ecde
Clarify that ssl.OP_ALL can be different from OpenSSL's SSL_OP_ALL.
2012-01-27 10:02:55 +01:00
ac8bfcacfc
Issue #13747 : fix SSL compatibility table.
2012-01-09 21:43:18 +01:00
Benjamin Peterson
Antoine Pitrou
Victor Stinner
Serhiy Storchaka
Georg Brandl
Berker Peksag
Zachary Ware
Giampaolo Rodola'
Donald Stufft
Larry Hastings
R David Murray
Christian Heimes
Terry Jan Reedy