diff options
| author | Kai Engert <kaie@kuix.de> | 2018-10-10 17:23:54 +0200 |
|---|---|---|
| committer | Alex Gaynor <alex.gaynor@gmail.com> | 2018-10-10 11:23:54 -0400 |
| commit | ef18e61594572e7f1f479d66c68dfbdfd9b49859 (patch) | |
| tree | 22648ac9af7c2c08ce8b9ae133f052a51994520e /src/_cffi_src/openssl/x509_vfy.py | |
| parent | 838bc4a95cd2d027fc5c165c07e8ac1039dd7192 (diff) | |
| download | cryptography-ef18e61594572e7f1f479d66c68dfbdfd9b49859.tar.gz cryptography-ef18e61594572e7f1f479d66c68dfbdfd9b49859.tar.bz2 cryptography-ef18e61594572e7f1f479d66c68dfbdfd9b49859.zip | |
Add definitions that help with hostname checking (#4492)
* Add definitions for SSL_get0_param and X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
* remove unnecessary parameter name
* Add version conditionals and more flags
* extend cryptography_has_102_verification_params
* X509_CHECK_FLAG_NEVER_CHECK_SUBJECT only available with openssl 1.1.0+
* add missing declaration
Diffstat (limited to 'src/_cffi_src/openssl/x509_vfy.py')
| -rw-r--r-- | src/_cffi_src/openssl/x509_vfy.py | 32 |
1 files changed, 32 insertions, 0 deletions
diff --git a/src/_cffi_src/openssl/x509_vfy.py b/src/_cffi_src/openssl/x509_vfy.py index 618b5c21..42da3b1e 100644 --- a/src/_cffi_src/openssl/x509_vfy.py +++ b/src/_cffi_src/openssl/x509_vfy.py @@ -21,6 +21,7 @@ typedef STACK_OF(X509_OBJECT) Cryptography_STACK_OF_X509_OBJECT; TYPES = """ static const long Cryptography_HAS_102_VERIFICATION_ERROR_CODES; static const long Cryptography_HAS_102_VERIFICATION_PARAMS; +static const long Cryptography_HAS_110_VERIFICATION_PARAMS; static const long Cryptography_HAS_X509_V_FLAG_TRUSTED_FIRST; static const long Cryptography_HAS_X509_V_FLAG_PARTIAL_CHAIN; static const long Cryptography_HAS_X509_STORE_CTX_GET_ISSUER; @@ -128,6 +129,13 @@ static const long X509_V_FLAG_PARTIAL_CHAIN; static const long X509_LU_X509; static const long X509_LU_CRL; + +static const long X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT; +static const long X509_CHECK_FLAG_NO_WILDCARDS; +static const long X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS; +static const long X509_CHECK_FLAG_MULTI_LABEL_WILDCARDS; +static const long X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS; +static const long X509_CHECK_FLAG_NEVER_CHECK_SUBJECT; """ FUNCTIONS = """ @@ -239,6 +247,21 @@ static const long X509_V_ERR_EMAIL_MISMATCH = 0; #ifndef X509_V_ERR_IP_ADDRESS_MISMATCH static const long X509_V_ERR_IP_ADDRESS_MISMATCH = 0; #endif +#ifndef X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT +static const long X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT = 0; +#endif +#ifndef X509_CHECK_FLAG_NO_WILDCARDS +static const long X509_CHECK_FLAG_NO_WILDCARDS = 0; +#endif +#ifndef X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS +static const long X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS = 0; +#endif +#ifndef X509_CHECK_FLAG_MULTI_LABEL_WILDCARDS +static const long X509_CHECK_FLAG_MULTI_LABEL_WILDCARDS = 0; +#endif +#ifndef X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS +static const long X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS = 0; +#endif /* X509_V_FLAG_TRUSTED_FIRST is also new in 1.0.2+, but it is added separately below because it shows up in some earlier 3rd party OpenSSL packages. */ @@ -259,6 +282,15 @@ void (*X509_VERIFY_PARAM_set_hostflags)(X509_VERIFY_PARAM *, #endif #endif +#if CRYPTOGRAPHY_OPENSSL_LESS_THAN_110 || CRYPTOGRAPHY_IS_LIBRESSL +static const long Cryptography_HAS_110_VERIFICATION_PARAMS = 0; +#ifndef X509_CHECK_FLAG_NEVER_CHECK_SUBJECT +static const long X509_CHECK_FLAG_NEVER_CHECK_SUBJECT = 0; +#endif +#else +static const long Cryptography_HAS_110_VERIFICATION_PARAMS = 1; +#endif + /* OpenSSL 1.0.2+ or Solaris's backport */ #ifdef X509_V_FLAG_PARTIAL_CHAIN static const long Cryptography_HAS_X509_V_FLAG_PARTIAL_CHAIN = 1; |