twisted.internet._sslverify

module documentation
(source)

Undocumented

Interface IOpenSSLTrustRoot Trust settings for an OpenSSL context.
Class CertBase Base class for public (certificate only) and private (certificate + key pair) certificates.
Class ClientTLSOptions Client creator for TLS.
Class OpenSSLCertificateAuthorities Trust an explicitly specified set of certificates, represented by a list of OpenSSL.crypto.X509 objects.
Class OpenSSLCipher A representation of an OpenSSL cipher.
Class PublicKey A PublicKey is a representation of the public part of a key pair.
Exception SimpleVerificationError Not a very useful verification error.
Function simpleVerifyHostname Check only the common name in the certificate presented by the peer and only for an exact match.
Function simpleVerifyIPAddress Always fails validation of IP addresses
Variable defaultCiphers Undocumented
Variable verifyHostname Undocumented
Variable verifyIPAddress Undocumented
Class _ChooseDiffieHellmanEllipticCurve Chooses the best elliptic curve for Elliptic Curve Diffie-Hellman key exchange, and provides a configureECDHCurve method to set the curve, when appropriate, on a new OpenSSL.SSL.Context.
Function _expandCipherString Expand cipherString according to method and options to a tuple of explicit ciphers that are supported by the current platform.
Function _getExcludedTLSProtocols Given a pair of TLSVersion constants, figure out what versions we want to disable (as OpenSSL is an exclusion based API).
Function _handleattrhelper (private) Helper for Certificate.peerFromTransport and Certificate.hostFromTransport which checks for incompatible handle types and null certificates and raises the appropriate exception or returns the appropriate certificate object.
Function _selectCiphers Caclulate the acceptable list of ciphers from the ciphers we want and the ciphers we have support for.
Function _selectVerifyImplementation Determine if service_identity is installed. If so, use it. If not, use simplistic and incorrect checking as implemented in simpleVerifyHostname.
Function _setAcceptableProtocols Called to set up the OpenSSL.SSL.Context for doing NPN and/or ALPN negotiation.
Function _tolerateErrors Wrap up an info_callback for pyOpenSSL so that if something goes wrong the error is immediately logged and the connection is dropped if possible.
Function _usablePyOpenSSL Check pyOpenSSL version string whether we can use it for host verification.
Variable _defaultCurveName Undocumented
Variable _tlsDisableFlags Undocumented
Variable _x509names Undocumented
def simpleVerifyHostname(connection, hostname): (source)

Check only the common name in the certificate presented by the peer and only for an exact match.

This is to provide something in the way of hostname verification to users who haven't installed service_identity. This check is overly strict, relies on a deprecated TLS feature (you're supposed to ignore the commonName if the subjectAlternativeName extensions are present, I believe), and lots of valid certificates will fail.

Parameters
connection:OpenSSL.SSL.Connectionthe OpenSSL connection to verify.
hostname:unicodeThe hostname expected by the user.
Raises
twisted.internet.ssl.VerificationErrorif the common name and hostname don't match.
def simpleVerifyIPAddress(connection, hostname): (source)

Always fails validation of IP addresses

Parameters
connection:OpenSSL.SSL.Connectionthe OpenSSL connection to verify.
hostname:unicodeThe hostname expected by the user.
Raises
twisted.internet.ssl.VerificationErrorAlways raised
defaultCiphers = (source)

Undocumented

verifyHostname = (source)

Undocumented

verifyIPAddress = (source)

Undocumented

@lru_cache(maxsize=32)
def _expandCipherString(cipherString, method, options): (source)

Expand cipherString according to method and options to a tuple of explicit ciphers that are supported by the current platform.

Parameters
cipherString:unicodeAn OpenSSL cipher string to expand.
methodAn OpenSSL method like SSL.TLS_METHOD used for determining the effective ciphers.
options:intOpenSSL options like SSL.OP_NO_SSLv3 ORed together.
Returns
tuple of ICipherThe effective list of explicit ciphers that results from the arguments on the current platform.
def _getExcludedTLSProtocols(oldest, newest): (source)

Given a pair of TLSVersion constants, figure out what versions we want to disable (as OpenSSL is an exclusion based API).

Parameters
oldest:TLSVersion constantThe oldest TLSVersion we want to allow.
newest:TLSVersion constant or NoneThe newest TLSVersion we want to allow, or None for no upper limit.
Returns
list of TLSVersion constants.The versions we want to disable.
def _handleattrhelper(Class, transport, methodName): (source)

(private) Helper for Certificate.peerFromTransport and Certificate.hostFromTransport which checks for incompatible handle types and null certificates and raises the appropriate exception or returns the appropriate certificate object.

@lru_cache(maxsize=128)
def _selectCiphers(wantedCiphers, availableCiphers): (source)

Caclulate the acceptable list of ciphers from the ciphers we want and the ciphers we have support for.

Parameters
wantedCiphers:tuple of OpenSSLCipherThe ciphers we want to use.
availableCiphers:tuple of OpenSSLCipherThe ciphers we have available to use.
Returns
tuple of OpenSSLCipherUndocumented
def _selectVerifyImplementation(): (source)

Determine if service_identity is installed. If so, use it. If not, use simplistic and incorrect checking as implemented in simpleVerifyHostname.

Returns
tuple2-tuple of (verify_hostname, VerificationError)
def _setAcceptableProtocols(context, acceptableProtocols): (source)

Called to set up the OpenSSL.SSL.Context for doing NPN and/or ALPN negotiation.

Parameters
context:OpenSSL.SSL.ContextThe context which is set up.
acceptableProtocols:list of bytesThe protocols this peer is willing to speak after the TLS negotiation has completed, advertised over both ALPN and NPN. If this argument is specified, and no overlap can be found with the other peer, the connection will fail to be established. If the remote peer does not offer NPN or ALPN, the connection will be established, but no protocol wil be negotiated. Protocols earlier in the list are preferred over those later in the list.
def _tolerateErrors(wrapped): (source)

Wrap up an info_callback for pyOpenSSL so that if something goes wrong the error is immediately logged and the connection is dropped if possible.

This wrapper exists because some versions of pyOpenSSL don't handle errors from callbacks at all, and those which do write tracebacks directly to stderr rather than to a supplied logging system. This reports unexpected errors to the Twisted logging system.

Also, this terminates the connection immediately if possible because if you've got bugs in your verification logic it's much safer to just give up.

Parameters
wrapped:callableA valid info_callback for pyOpenSSL.
Returns
callableA valid info_callback for pyOpenSSL that handles any errors in wrapped.
def _usablePyOpenSSL(version): (source)

Check pyOpenSSL version string whether we can use it for host verification.

Parameters
version:strA pyOpenSSL version string.
Returns
boolUndocumented
_defaultCurveName: str = (source)

Undocumented

_tlsDisableFlags = (source)

Undocumented

_x509names: dict[str, str] = (source)

Undocumented