Add TLS version numbers and remove unsupported TLS options

mistotebe · mistotebe · commit 5cac85a7afea · 2022-04-20T14:50:58.000+01:00
Closes python-ldap#67
diff --git a/Doc/reference/ldap.rst b/Doc/reference/ldap.rst
@@ -372,21 +372,27 @@ TLS options
 .. py:data:: OPT_X_TLS_ALLOW
 
    Value for :py:const:`OPT_X_TLS_REQUIRE_CERT`
+   and :py:const:`OPT_X_TLS_REQUIRE_SAN`
 
 .. py:data:: OPT_X_TLS_DEMAND
 
    Value for :py:const:`OPT_X_TLS_REQUIRE_CERT`
+   and :py:const:`OPT_X_TLS_REQUIRE_SAN`
 
 .. py:data:: OPT_X_TLS_HARD
 
    Value for :py:const:`OPT_X_TLS_REQUIRE_CERT`
+   and :py:const:`OPT_X_TLS_REQUIRE_SAN`
 
 .. py:data:: OPT_X_TLS_NEVER
 
    Value for :py:const:`OPT_X_TLS_REQUIRE_CERT`
+   and :py:const:`OPT_X_TLS_REQUIRE_SAN`
 
 .. py:data:: OPT_X_TLS_TRY
 
+   Value for :py:const:`OPT_X_TLS_REQUIRE_CERT`
+
    .. deprecated:: 3.3.0
       This value is only used by slapd server internally. It will be removed
       in the future.
@@ -400,10 +406,6 @@ TLS options
 
    get/set allowed cipher suites
 
-.. py:data:: OPT_X_TLS_CTX
-
-   get address of internal memory address of TLS context (**DO NOT USE**)
-
 .. py:data:: OPT_X_TLS_PEERCERT
 
    Get peer's certificate as binary ASN.1 data structure (DER)
@@ -417,8 +419,47 @@ TLS options
 
    get/set minimum protocol version (wire protocol version as int)
 
-   * ``0x303`` for TLS 1.2
-   * ``0x304`` for TLS 1.3
+.. py:data:: OPT_X_TLS_PROTOCOL_MAX
+
+   get/set maximum protocol version (wire protocol version as int),
+   available in OpenSSL 2.5 and newer.
+
+   .. versionadded:: 3.4.1
+
+.. py:data:: OPT_X_TLS_PROTOCOL_SSL3
+
+   Value for :py:const:`OPT_X_TLS_PROTOCOL_MIN` and
+   :py:const:`OPT_X_TLS_PROTOCOL_MAX`, represents SSL 3
+
+   .. versionadded:: 3.4.1
+
+.. py:data:: OPT_X_TLS_PROTOCOL_TLS1_0
+
+   Value for :py:const:`OPT_X_TLS_PROTOCOL_MIN` and
+   :py:const:`OPT_X_TLS_PROTOCOL_MAX`, represents TLS 1.0
+
+   .. versionadded:: 3.4.1
+
+.. py:data:: OPT_X_TLS_PROTOCOL_TLS1_1
+
+   Value for :py:const:`OPT_X_TLS_PROTOCOL_MIN` and
+   :py:const:`OPT_X_TLS_PROTOCOL_MAX`, represents TLS 1.1
+
+   .. versionadded:: 3.4.1
+
+.. py:data:: OPT_X_TLS_PROTOCOL_TLS1_2
+
+   Value for :py:const:`OPT_X_TLS_PROTOCOL_MIN` and
+   :py:const:`OPT_X_TLS_PROTOCOL_MAX`, represents TLS 1.2
+
+   .. versionadded:: 3.4.1
+
+.. py:data:: OPT_X_TLS_PROTOCOL_TLS1_3
+
+   Value for :py:const:`OPT_X_TLS_PROTOCOL_MIN` and
+   :py:const:`OPT_X_TLS_PROTOCOL_MAX`, represents TLS 1.3
+
+   .. versionadded:: 3.4.1
 
 .. py:data:: OPT_X_TLS_VERSION
 
@@ -428,12 +469,6 @@ TLS options
 
    get/set path to /dev/urandom (**DO NOT USE**)
 
-.. py:data:: OPT_X_TLS
-
-   .. deprecated:: 3.3.0
-      The option is deprecated in OpenLDAP and should no longer be used. It
-      will be removed in the future.
-
 .. note::
 
    OpenLDAP supports several TLS/SSL libraries. OpenSSL is the most common
@@ -923,11 +958,6 @@ and wait for and return with the server's result, or with
 
    The *dn* and *attr* arguments are text strings; see :ref:`bytes_mode`.
 
-   .. note::
-
-      A design fault in the LDAP API prevents *value*
-      from containing *NULL* characters.
-
 
 .. py:method:: LDAPObject.delete(dn) -> int
 
diff --git a/Lib/ldap/constants.py b/Lib/ldap/constants.py
@@ -267,8 +267,6 @@ class Str(Constant):
 
     Int('OPT_DEFBASE', optional=True),
 
-    TLSInt('OPT_X_TLS', optional=True),
-    TLSInt('OPT_X_TLS_CTX'),
     TLSInt('OPT_X_TLS_CACERTFILE'),
     TLSInt('OPT_X_TLS_CACERTDIR'),
     TLSInt('OPT_X_TLS_CERTFILE'),
@@ -306,6 +304,13 @@ class Str(Constant):
 
     # Added in OpenLDAP 2.5
     TLSInt('OPT_X_TLS_PEERCERT', optional=True),
+    TLSInt('OPT_X_TLS_PROTOCOL_MAX', optional=True),
+
+    TLSInt('OPT_X_TLS_PROTOCOL_SSL3', optional=True),
+    TLSInt('OPT_X_TLS_PROTOCOL_TLS1_0', optional=True),
+    TLSInt('OPT_X_TLS_PROTOCOL_TLS1_1', optional=True),
+    TLSInt('OPT_X_TLS_PROTOCOL_TLS1_2', optional=True),
+    TLSInt('OPT_X_TLS_PROTOCOL_TLS1_3', optional=True),
 
     Int('OPT_X_SASL_MECH'),
     Int('OPT_X_SASL_REALM'),
diff --git a/Modules/constants_generated.h b/Modules/constants_generated.h
@@ -202,12 +202,6 @@ add_int(OPT_DEFBASE);
 
 
 #if HAVE_TLS
-
-#if defined(LDAP_OPT_X_TLS)
-add_int(OPT_X_TLS);
-#endif
-
-add_int(OPT_X_TLS_CTX);
 add_int(OPT_X_TLS_CACERTFILE);
 add_int(OPT_X_TLS_CACERTDIR);
 add_int(OPT_X_TLS_CERTFILE);
@@ -279,6 +273,36 @@ add_int(OPT_X_TLS_REQUIRE_SAN);
 add_int(OPT_X_TLS_PEERCERT);
 #endif
 
+
+#if defined(LDAP_OPT_X_TLS_PROTOCOL_MAX)
+add_int(OPT_X_TLS_PROTOCOL_MAX);
+#endif
+
+
+#if defined(LDAP_OPT_X_TLS_PROTOCOL_SSL3)
+add_int(OPT_X_TLS_PROTOCOL_SSL3);
+#endif
+
+
+#if defined(LDAP_OPT_X_TLS_PROTOCOL_TLS1_0)
+add_int(OPT_X_TLS_PROTOCOL_TLS1_0);
+#endif
+
+
+#if defined(LDAP_OPT_X_TLS_PROTOCOL_TLS1_1)
+add_int(OPT_X_TLS_PROTOCOL_TLS1_1);
+#endif
+
+
+#if defined(LDAP_OPT_X_TLS_PROTOCOL_TLS1_2)
+add_int(OPT_X_TLS_PROTOCOL_TLS1_2);
+#endif
+
+
+#if defined(LDAP_OPT_X_TLS_PROTOCOL_TLS1_3)
+add_int(OPT_X_TLS_PROTOCOL_TLS1_3);
+#endif
+
 #endif
 
 add_int(OPT_X_SASL_MECH);
diff --git a/Modules/options.c b/Modules/options.c
@@ -98,6 +98,9 @@ LDAP_set_option(LDAPObject *self, int option, PyObject *value)
 #ifdef LDAP_OPT_X_TLS_PROTOCOL_MIN
     case LDAP_OPT_X_TLS_PROTOCOL_MIN:
 #endif
+#ifdef LDAP_OPT_X_TLS_PROTOCOL_MAX
+    case LDAP_OPT_X_TLS_PROTOCOL_MAX:
+#endif
 #ifdef LDAP_OPT_X_TLS_REQUIRE_SAN
     case LDAP_OPT_X_TLS_REQUIRE_SAN:
 #endif
@@ -344,6 +347,9 @@ LDAP_get_option(LDAPObject *self, int option)
 #ifdef LDAP_OPT_X_TLS_PROTOCOL_MIN
     case LDAP_OPT_X_TLS_PROTOCOL_MIN:
 #endif
+#ifdef LDAP_OPT_X_TLS_PROTOCOL_MAX
+    case LDAP_OPT_X_TLS_PROTOCOL_MAX:
+#endif
 #ifdef LDAP_OPT_X_TLS_REQUIRE_SAN
     case LDAP_OPT_X_TLS_REQUIRE_SAN:
 #endif
