From 89c354c941a8f424b5cb986625eb5b612901c586 Mon Sep 17 00:00:00 2001 From: Chris Burr Date: Wed, 15 Jan 2020 11:16:27 +0100 Subject: [PATCH 1/2] bpo-39342: Expose X509_V_FLAG_ALLOW_PROXY_CERTS as ssl.VERIFY_ALLOW_PROXY_CERTS --- Doc/library/ssl.rst | 7 +++++++ Lib/test/test_ssl.py | 2 ++ .../next/Library/2020-01-15-11-15-35.bpo-39342.S8PuJO.rst | 4 ++++ Modules/_ssl.c | 2 ++ 4 files changed, 15 insertions(+) create mode 100644 Misc/NEWS.d/next/Library/2020-01-15-11-15-35.bpo-39342.S8PuJO.rst diff --git a/Doc/library/ssl.rst b/Doc/library/ssl.rst index 1cfd165202d0ef..0259f86a1febe0 100644 --- a/Doc/library/ssl.rst +++ b/Doc/library/ssl.rst @@ -634,6 +634,13 @@ Constants .. versionadded:: 3.4 +.. data:: VERIFY_ALLOW_PROXY_CERTS + + Possible value for :attr:`SSLContext.verify_flags` to enables proxy + certificate verification. + + .. versionadded:: 3.9 + .. data:: VERIFY_X509_TRUSTED_FIRST Possible value for :attr:`SSLContext.verify_flags`. It instructs OpenSSL to diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py index 67850c34e00c20..1710dda4389a04 100644 --- a/Lib/test/test_ssl.py +++ b/Lib/test/test_ssl.py @@ -1305,6 +1305,8 @@ def test_verify_flags(self): self.assertEqual(ctx.verify_flags, ssl.VERIFY_CRL_CHECK_CHAIN) ctx.verify_flags = ssl.VERIFY_DEFAULT self.assertEqual(ctx.verify_flags, ssl.VERIFY_DEFAULT) + ctx.verify_flags = ssl.VERIFY_ALLOW_PROXY_CERTS + self.assertEqual(ctx.verify_flags, ssl.VERIFY_ALLOW_PROXY_CERTS) # supports any value ctx.verify_flags = ssl.VERIFY_CRL_CHECK_LEAF | ssl.VERIFY_X509_STRICT self.assertEqual(ctx.verify_flags, diff --git a/Misc/NEWS.d/next/Library/2020-01-15-11-15-35.bpo-39342.S8PuJO.rst b/Misc/NEWS.d/next/Library/2020-01-15-11-15-35.bpo-39342.S8PuJO.rst new file mode 100644 index 00000000000000..6eb83a95b5e2c0 --- /dev/null +++ b/Misc/NEWS.d/next/Library/2020-01-15-11-15-35.bpo-39342.S8PuJO.rst @@ -0,0 +1,4 @@ +Expose ``X509_V_FLAG_ALLOW_PROXY_CERTS`` as +:data:`~ssl.VERIFY_ALLOW_PROXY_CERTS` to allow proxy certificate validation +as explained in +https://www.openssl.org/docs/man1.1.1/man7/proxy-certificates.html. diff --git a/Modules/_ssl.c b/Modules/_ssl.c index 96d2796fcfad48..bea144cd9f9563 100644 --- a/Modules/_ssl.c +++ b/Modules/_ssl.c @@ -6181,6 +6181,8 @@ sslmodule_init_constants(PyObject *m) X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL); PyModule_AddIntConstant(m, "VERIFY_X509_STRICT", X509_V_FLAG_X509_STRICT); + PyModule_AddIntConstant(m, "VERIFY_ALLOW_PROXY_CERTS", + X509_V_FLAG_ALLOW_PROXY_CERTS); #ifdef X509_V_FLAG_TRUSTED_FIRST PyModule_AddIntConstant(m, "VERIFY_X509_TRUSTED_FIRST", X509_V_FLAG_TRUSTED_FIRST); From 065c1ccdb87fbc3016cf3af9378748f435518e9b Mon Sep 17 00:00:00 2001 From: Chris Burr Date: Wed, 9 Dec 2020 15:06:31 +0100 Subject: [PATCH 2/2] bpo-39342: Update added in version to 3.10 --- Doc/library/ssl.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Doc/library/ssl.rst b/Doc/library/ssl.rst index 0259f86a1febe0..1adac843f4eec9 100644 --- a/Doc/library/ssl.rst +++ b/Doc/library/ssl.rst @@ -639,7 +639,7 @@ Constants Possible value for :attr:`SSLContext.verify_flags` to enables proxy certificate verification. - .. versionadded:: 3.9 + .. versionadded:: 3.10 .. data:: VERIFY_X509_TRUSTED_FIRST pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.

Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy