Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add SSLContext.set_version_range(minver, maxver=None) #72063

Closed
tiran opened this issue Aug 27, 2016 · 3 comments
Closed

Add SSLContext.set_version_range(minver, maxver=None) #72063

tiran opened this issue Aug 27, 2016 · 3 comments
Assignees
Labels
3.7 (EOL) end of life extension-modules C modules in the Modules dir topic-SSL type-feature A feature request or enhancement

Comments

@tiran
Copy link
Member

tiran commented Aug 27, 2016

BPO 27876
Nosy @tiran, @alex, @dstufft
Superseder
  • bpo-32609: Add setter and getter for min/max protocol version
  • Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

    Show more details

    GitHub fields:

    assignee = 'https://github.com/tiran'
    closed_at = <Date 2018-02-25.20:25:37.350>
    created_at = <Date 2016-08-27.10:30:35.805>
    labels = ['extension-modules', 'expert-SSL', 'type-feature', '3.7']
    title = 'Add SSLContext.set_version_range(minver, maxver=None)'
    updated_at = <Date 2018-02-25.20:25:37.349>
    user = 'https://github.com/tiran'

    bugs.python.org fields:

    activity = <Date 2018-02-25.20:25:37.349>
    actor = 'christian.heimes'
    assignee = 'christian.heimes'
    closed = True
    closed_date = <Date 2018-02-25.20:25:37.350>
    closer = 'christian.heimes'
    components = ['Extension Modules', 'SSL']
    creation = <Date 2016-08-27.10:30:35.805>
    creator = 'christian.heimes'
    dependencies = []
    files = []
    hgrepos = []
    issue_num = 27876
    keywords = []
    message_count = 3.0
    messages = ['273772', '284822', '312853']
    nosy_count = 4.0
    nosy_names = ['janssen', 'christian.heimes', 'alex', 'dstufft']
    pr_nums = []
    priority = 'normal'
    resolution = 'duplicate'
    stage = 'resolved'
    status = 'closed'
    superseder = '32609'
    type = 'enhancement'
    url = 'https://bugs.python.org/issue27876'
    versions = ['Python 3.7']

    @tiran
    Copy link
    Member Author

    tiran commented Aug 27, 2016

    OpenSSL 1.1 has deprecated all version specific TLS/SSL methods in favor of auto-negotiation (formerly known as SSLv23). It also introduced two macros to set the minimal and maximum TLS version with SSL_CTX_set_min_proto_version() and SSL_CTX_set_max_proto_version(). The macros can be emulated for OpenSSL < 1.1 with reasonable effort.

    I suggest that ssl.SSLContext introduces set_version_range(minver, maxver=None) method. It's less awkward to use than fiddling with modes and OP_NO_SSLv3.

    @tiran tiran added extension-modules C modules in the Modules dir type-feature A feature request or enhancement labels Aug 27, 2016
    @tiran tiran self-assigned this Sep 15, 2016
    @tiran
    Copy link
    Member Author

    tiran commented Jan 6, 2017

    PoC implementation:

    from enum import Enum
    import ssl
    
    OP_NO_TLSv1_3 = getattr(ssl, 'OP_NO_TLSv1_3', 0)
    
    OP_NO_FLAGS = [
        ssl.OP_NO_SSLv2,
        ssl.OP_NO_SSLv3,
        ssl.OP_NO_TLSv1,
        ssl.OP_NO_TLSv1_1,
        ssl.OP_NO_TLSv1_2,
        OP_NO_TLSv1_3
    ]
    
    OP_NO_MASK = sum(OP_NO_FLAGS)
    
    
    class TLSVersions(Enum):
        SSLv2 = 'SSL 2.0', 0x0200, 0
        SSLv3 = 'SSL 3.0', 0x0300, 1
        TLSv1 = 'TLS 1.0', 0x0301, 2
        TLSv1_1 = 'TLS 1.1', 0x0302, 3
        TLSv1_2 = 'TLS 1.2', 0x0303, 4
    
        if OP_NO_TLSv1_3:
            TLSv1_3 = 'TLS 1.3', 0x0304, 5
            MAX = TLSv1_3
        else:
            MAX = TLSv1_2
    
        MIN = TLSv1
    
        def __init__(self, prettyname, wireprotocol, offset):
            self.prettyname = prettyname
            self.wireprotocol = wireprotocol
            self.noflag = OP_NO_FLAGS[offset]
            self.minflag = sum(OP_NO_FLAGS[:offset])
            self.maxflag = sum(OP_NO_FLAGS[offset+1:])
    
        def __repr__(self):
            return ("<{0.__class__.__name__}.{0.name} "
                    "({0.prettyname}, 0x{0.wireprotocol:x})>").format(self)
    
        __str__ = __repr__
    
    
    class SSLContext(ssl.SSLContext):
        def set_version(self, minver=TLSVersions.MIN, maxver=TLSVersions.MAX):
            options = self.options & ~OP_NO_MASK
            self.options = options | minver.minflag | maxver.maxflag
    
    
    if __name__ == '__main__':
        for name, member in TLSVersions.__members__.items():
            print(name, member)
    
        ctx = SSLContext(ssl.PROTOCOL_SSLv23)
        print(ctx.options)
        ctx.set_version(minver=TLSVersions.SSLv3, maxver=TLSVersions.TLSv1_1)
        print(ctx.options)

    @tiran tiran added the 3.7 (EOL) end of life label Jan 6, 2017
    @tiran
    Copy link
    Member Author

    tiran commented Feb 25, 2018

    My issue bpo-32609 provides a better implementation.

    @tiran tiran closed this as completed Feb 25, 2018
    @ezio-melotti ezio-melotti transferred this issue from another repository Apr 10, 2022
    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
    Labels
    3.7 (EOL) end of life extension-modules C modules in the Modules dir topic-SSL type-feature A feature request or enhancement
    Projects
    None yet
    Development

    No branches or pull requests

    1 participant