Hello,
I would like to ask a few questions and suggestions regarding the ssl
module (in Python 2.6). (I gather from [1] that there is some effort
going on to enhance the ssl API, but I'm not sure if this is the right
place to discuss it.)
Like other Python users, I was a bit surprised by the lack of
verification of httplib/urllib2 (hence I started to write a small
library a while back, only published today [2]), but the following
points are not HTTP-specific.
1. Hostname checking.
From what I gather by reading the archives on this list, the issue of
hostname checking seems controversial [3]. It seems widely admitted by
browser communities nowadays to check that the hostname the CN field of
the subject DN or the DNS entries of subjectAltName. I'd feel more
comfortable if this was the default behaviour of the client in Python's
SSL module, although having a mechanism to override this would be useful
indeed. It's more or less a basic security requirement to check the
identity of the server before doing anything else.
2. Cipher suite selection.
It's useful to restrict the list of cipher suites that can be used,
not just for speed (as mentioned in [1]), but also because some cipher
suites may be considered insecure by some institutions. This would be a
good feature to have indeed.
3. Full chain of certificates.
The PyOpenSSL module is able to take a callback function that
verifies each certificate in the chain (using depth). According to the
documentation, the ssl module only exposes the first certificate in the
chain (no CA). In some applications, it is useful to verify certain
policies according to attributes further up in the chain.
I'd like to suggest having an
"SSLSocket.getpeercerts(binary_form=False)" (plural) that returns a list
of certificates in the verification chain.
Is there a place where the status of the ssl module is summarized, or a
better place to discuss this? I could try to provide contributions or
further details if appropriate.
Best wishes,
Bruno.
[1] http://mail.python.org/pipermail/python-dev/2009-September/091636.html
[2] http://code.google.com/p/python-httpclient
[2] http://bugs.python.org/issue1589
_______________________________________________
Python-Dev mailing list
Python-Dev@python.org
http://mail.python.org/mailman/listinfo/python-dev
Unsubscribe:
http://mail.python.org/mailman/options/python-dev/archive%40mail-archive.com
