Add SSLContext.set_version_range(minver, maxver=None) #72063

Activity

1. tiran commented on Aug 27, 2016

   

   tiran

   on Aug 27, 2016

   MemberAuthor

   More actions

   OpenSSL 1.1 has deprecated all version specific TLS/SSL methods in favor of auto-negotiation (formerly known as SSLv23). It also introduced two macros to set the minimal and maximum TLS version with SSL_CTX_set_min_proto_version() and SSL_CTX_set_max_proto_version(). The macros can be emulated for OpenSSL < 1.1 with reasonable effort.

   I suggest that ssl.SSLContext introduces set_version_range(minver, maxver=None) method. It's less awkward to use than fiddling with modes and OP_NO_SSLv3.
2. tiran

   added

   extension-modulesC modules in the Modules dirC modules in the Modules dir

   type-featureA feature request or enhancementA feature request or enhancement

   on Aug 27, 2016
3. tiran

   added

   topic-SSL

   on Sep 15, 2016
4. tiran

   self-assigned this

   on Sep 15, 2016
5. tiran commented on Jan 6, 2017

   

   tiran

   on Jan 6, 2017

   MemberAuthor

   More actions

   PoC implementation:

   from enum import Enum
   import ssl
   
   OP_NO_TLSv1_3 = getattr(ssl, 'OP_NO_TLSv1_3', 0)
   
   OP_NO_FLAGS = [
       ssl.OP_NO_SSLv2,
       ssl.OP_NO_SSLv3,
       ssl.OP_NO_TLSv1,
       ssl.OP_NO_TLSv1_1,
       ssl.OP_NO_TLSv1_2,
       OP_NO_TLSv1_3
   ]
   
   OP_NO_MASK = sum(OP_NO_FLAGS)
   
   
   class TLSVersions(Enum):
       SSLv2 = 'SSL 2.0', 0x0200, 0
       SSLv3 = 'SSL 3.0', 0x0300, 1
       TLSv1 = 'TLS 1.0', 0x0301, 2
       TLSv1_1 = 'TLS 1.1', 0x0302, 3
       TLSv1_2 = 'TLS 1.2', 0x0303, 4
   
       if OP_NO_TLSv1_3:
           TLSv1_3 = 'TLS 1.3', 0x0304, 5
           MAX = TLSv1_3
       else:
           MAX = TLSv1_2
   
       MIN = TLSv1
   
       def __init__(self, prettyname, wireprotocol, offset):
           self.prettyname = prettyname
           self.wireprotocol = wireprotocol
           self.noflag = OP_NO_FLAGS[offset]
           self.minflag = sum(OP_NO_FLAGS[:offset])
           self.maxflag = sum(OP_NO_FLAGS[offset+1:])
   
       def __repr__(self):
           return ("<{0.__class__.__name__}.{0.name} "
                   "({0.prettyname}, 0x{0.wireprotocol:x})>").format(self)
   
       __str__ = __repr__
   
   
   class SSLContext(ssl.SSLContext):
       def set_version(self, minver=TLSVersions.MIN, maxver=TLSVersions.MAX):
           options = self.options & ~OP_NO_MASK
           self.options = options | minver.minflag | maxver.maxflag
   
   
   if __name__ == '__main__':
       for name, member in TLSVersions.__members__.items():
           print(name, member)
   
       ctx = SSLContext(ssl.PROTOCOL_SSLv23)
       print(ctx.options)
       ctx.set_version(minver=TLSVersions.SSLv3, maxver=TLSVersions.TLSv1_1)
       print(ctx.options)
6. tiran

   added

   3.7 (EOL)end of lifeend of life

   on Jan 6, 2017
7. tiran commented on Feb 25, 2018

   

   tiran

   on Feb 25, 2018

   MemberAuthor

   More actions

   My issue bpo-32609 provides a better implementation.
8. tiran

   closed this as completedon Feb 25, 2018
9. ezio-melotti

   transferred this issue fromon Apr 10, 2022