Go to the latest version of this document.

# ``twisted`.`internet`.`_sslverify``

module documentation
(source)

Undocumented

Interface | `IOpenSSLTrustRoot` | Trust settings for an OpenSSL context.
Class | `CertBase` | Base class for public (certificate only) and private (certificate + key pair) certificates.
Class | `ClientTLSOptions` | Client creator for TLS.
Class | `OpenSSLCertificateAuthorities` | Trust an explicitly specified set of certificates, represented by a list of `OpenSSL.crypto.X509` objects.
Class | `OpenSSLCipher` | A representation of an OpenSSL cipher.
Class | `PublicKey` | A `PublicKey` is a representation of the public part of a key pair.
Exception | `SimpleVerificationError` | Not a very useful verification error.
Function | `simpleVerifyHostname` | Check only the common name in the certificate presented by the peer and only for an exact match.
Function | `simpleVerifyIPAddress` | Always fails validation of IP addresses
Variable | `defaultCiphers` | Undocumented
Variable | `verifyHostname` | Undocumented
Variable | `verifyIPAddress` | Undocumented
Class | `_ChooseDiffieHellmanEllipticCurve` | Chooses the best elliptic curve for Elliptic Curve Diffie-Hellman key exchange, and provides a `configureECDHCurve` method to set the curve, when appropriate, on a new `OpenSSL.SSL.Context`.
Function | `_expandCipherString` | Expand `cipherString` according to `method` and `options` to a tuple of explicit ciphers that are supported by the current platform.
Function | `_getExcludedTLSProtocols` | Given a pair of `TLSVersion` constants, figure out what versions we want to disable (as OpenSSL is an exclusion based API).
Function | `_handleattrhelper` | (private) Helper for `Certificate.peerFromTransport` and `Certificate.hostFromTransport` which checks for incompatible handle types and null certificates and raises the appropriate exception or returns the appropriate certificate object.
Function | `_selectCiphers` | Caclulate the acceptable list of ciphers from the ciphers we want and the ciphers we have support for.
Function | `_selectVerifyImplementation` | Determine if `service_identity` is installed. If so, use it. If not, use simplistic and incorrect checking as implemented in `simpleVerifyHostname`.
Function | `_setAcceptableProtocols` | Called to set up the `OpenSSL.SSL.Context` for doing NPN and/or ALPN negotiation.
Function | `_tolerateErrors` | Wrap up an `info_callback` for pyOpenSSL so that if something goes wrong the error is immediately logged and the connection is dropped if possible.
Function | `_usablePyOpenSSL` | Check pyOpenSSL version string whether we can use it for host verification.
Variable | `_defaultCurveName` | Undocumented
Variable | `_log` | Undocumented
Variable | `_tlsDisableFlags` | Undocumented
Variable | `_x509names` | Undocumented

def simpleVerifyHostname(connection, hostname): (source)

Check only the common name in the certificate presented by the peer and only for an exact match.

This is to provide something in the way of hostname verification to users who haven't installed `service_identity`. This check is overly strict, relies on a deprecated TLS feature (you're supposed to ignore the commonName if the subjectAlternativeName extensions are present, I believe), and lots of valid certificates will fail.

Parameters
connection:`OpenSSL.SSL.Connection` | the OpenSSL connection to verify.
hostname:`unicode` | The hostname expected by the user.

Raises
`twisted.internet.ssl.VerificationError` | if the common name and hostname don't match.

def simpleVerifyIPAddress(connection, hostname): (source)

Always fails validation of IP addresses

Parameters
connection:`OpenSSL.SSL.Connection` | the OpenSSL connection to verify.
hostname:`unicode` | The hostname expected by the user.

Raises
`twisted.internet.ssl.VerificationError` | Always raised

defaultCiphers = (source)

Undocumented

verifyHostname = (source)

Undocumented

verifyIPAddress = (source)

Undocumented

@lru_cache(maxsize=32)
def _expandCipherString(cipherString, method, options): (source)

Expand `cipherString` according to `method` and `options` to a tuple of explicit ciphers that are supported by the current platform.

Parameters
cipherString:`unicode` | An OpenSSL cipher string to expand.
method | An OpenSSL method like `SSL.TLS_METHOD` used for determining the effective ciphers.
options:`int` | OpenSSL options like `SSL.OP_NO_SSLv3` ORed together.

Returns
`tuple` of `ICipher` | The effective list of explicit ciphers that results from the arguments on the current platform.

def _getExcludedTLSProtocols(oldest, newest): (source)

Given a pair of `TLSVersion` constants, figure out what versions we want to disable (as OpenSSL is an exclusion based API).

Parameters
oldest:`TLSVersion` constant | The oldest `TLSVersion` we want to allow.
newest:`TLSVersion` constant or `None` | The newest `TLSVersion` we want to allow, or `None` for no upper limit.

Returns
`list` of `TLSVersion` constants. | The versions we want to disable.

def _handleattrhelper(Class, transport, methodName): (source)

(private) Helper for `Certificate.peerFromTransport` and `Certificate.hostFromTransport` which checks for incompatible handle types and null certificates and raises the appropriate exception or returns the appropriate certificate object.

@lru_cache(maxsize=128)
def _selectCiphers(wantedCiphers, availableCiphers): (source)

Caclulate the acceptable list of ciphers from the ciphers we want and the ciphers we have support for.

Parameters
wantedCiphers:`tuple` of `OpenSSLCipher` | The ciphers we want to use.
availableCiphers:`tuple` of `OpenSSLCipher` | The ciphers we have available to use.

Returns
`tuple` of `OpenSSLCipher` | Undocumented

def _selectVerifyImplementation(): (source)

Determine if `service_identity` is installed. If so, use it. If not, use simplistic and incorrect checking as implemented in `simpleVerifyHostname`.

Returns
`tuple` | 2-tuple of (`verify_hostname`, `VerificationError`)

def _setAcceptableProtocols(context, acceptableProtocols): (source)

Called to set up the `OpenSSL.SSL.Context` for doing NPN and/or ALPN negotiation.

Parameters
context:`OpenSSL.SSL.Context` | The context which is set up.

acceptableProtocols:`list` of `bytes`

The protocols this peer is willing to speak after the TLS negotiation has completed, advertised over both ALPN and NPN. If this argument is specified, and no overlap can be found with the other peer, the connection will fail to be established. If the remote peer does not offer NPN or ALPN, the connection will be established, but no protocol wil be negotiated. Protocols earlier in the list are preferred over those later in the list.

def _tolerateErrors(wrapped): (source)

Wrap up an `info_callback` for pyOpenSSL so that if something goes wrong the error is immediately logged and the connection is dropped if possible.

This wrapper exists because some versions of pyOpenSSL don't handle errors from callbacks at all, and those which do write tracebacks directly to stderr rather than to a supplied logging system. This reports unexpected errors to the Twisted logging system.

Also, this terminates the connection immediately if possible because if you've got bugs in your verification logic it's much safer to just give up.

Parameters
wrapped:`callable` | A valid `info_callback` for pyOpenSSL.

Returns
`callable` | A valid `info_callback` for pyOpenSSL that handles any errors in `wrapped`.

def _usablePyOpenSSL(version): (source)

Check pyOpenSSL version string whether we can use it for host verification.

Parameters
version:`str` | A pyOpenSSL version string.

Returns
`bool` | Undocumented

_defaultCurveName: `str` = (source)

Undocumented

_log = (source)

Undocumented

_tlsDisableFlags = (source)

Undocumented

_x509names: `dict[str, str]` = (source)

Undocumented