diff options
Diffstat (limited to 'src')
| -rw-r--r-- | src/cryptography/hazmat/backends/interfaces.py | 52 | ||||
| -rw-r--r-- | src/cryptography/hazmat/bindings/openssl/ssl.py | 31 |
2 files changed, 83 insertions, 0 deletions
diff --git a/src/cryptography/hazmat/backends/interfaces.py b/src/cryptography/hazmat/backends/interfaces.py index 5224f5c7..eca7ddf4 100644 --- a/src/cryptography/hazmat/backends/interfaces.py +++ b/src/cryptography/hazmat/backends/interfaces.py @@ -273,3 +273,55 @@ class X509Backend(object): """ Load an X.509 CSR from PEM encoded data. """ + + +@six.add_metaclass(abc.ABCMeta) +class DHBackend(object): + @abc.abstractmethod + def generate_dh_parameters(self, key_size): + """ + Generate a DHParameters instance with a modulus of key_size bits. + """ + + @abc.abstractmethod + def generate_dh_private_key(self, parameters): + """ + Generate a DHPrivateKey instance with parameters as a DHParameters + object. + """ + + @abc.abstractmethod + def generate_dh_private_key_and_parameters(self, key_size): + """ + Generate a DHPrivateKey instance using key size only. + """ + + @abc.abstractmethod + def load_dh_private_numbers(self, numbers): + """ + Returns a DHPrivateKey provider. + """ + + @abc.abstractmethod + def load_dh_public_numbers(self, numbers): + """ + Returns a DHPublicKey provider. + """ + + @abc.abstractmethod + def load_dh_parameter_numbers(self, numbers): + """ + Returns a DHParameters provider. + """ + + @abc.abstractmethod + def dh_exchange_algorithm_supported(self, exchange_algorithm): + """ + Returns whether the exchange algorithm is supported by this backend. + """ + + @abc.abstractmethod + def dh_parameters_supported(self, p, g): + """ + Returns whether the backend supports DH with these parameter values. + """ diff --git a/src/cryptography/hazmat/bindings/openssl/ssl.py b/src/cryptography/hazmat/bindings/openssl/ssl.py index 6161a9d1..b182180f 100644 --- a/src/cryptography/hazmat/bindings/openssl/ssl.py +++ b/src/cryptography/hazmat/bindings/openssl/ssl.py @@ -20,6 +20,8 @@ static const long Cryptography_HAS_TLSv1_1; static const long Cryptography_HAS_TLSv1_2; static const long Cryptography_HAS_SECURE_RENEGOTIATION; static const long Cryptography_HAS_COMPRESSION; +static const long Cryptography_HAS_TLSEXT_STATUS_REQ_CB; +static const long Cryptography_HAS_STATUS_REQ_OCSP_RESP; /* Internally invented symbol to tell us if SNI is supported */ static const long Cryptography_HAS_TLSEXT_HOSTNAME; @@ -304,6 +306,7 @@ SSL_CTX *SSL_CTX_new(SSL_METHOD *); long SSL_CTX_get_timeout(const SSL_CTX *); const SSL_CIPHER *SSL_get_current_cipher(const SSL *); +const char *SSL_get_version(const SSL *); int SSL_version(const SSL *); /* SNI APIs were introduced in OpenSSL 1.0.0. To continue to support @@ -315,6 +318,12 @@ void SSL_CTX_set_tlsext_servername_callback( SSL_CTX *, int (*)(const SSL *, int *, void *)); +/* These were added in OpenSSL 0.9.8h, but since version testing in OpenSSL + is fraught with peril thanks to OS distributions we check some constants + to determine if they are supported or not */ +long SSL_set_tlsext_status_ocsp_resp(SSL *, unsigned char *, int); +long SSL_CTX_set_tlsext_status_cb(SSL_CTX *, int(*)(SSL *, void *)); + long SSL_session_reused(SSL *); /* The following were macros in 0.9.8e. Once we drop support for RHEL/CentOS 5 @@ -410,6 +419,20 @@ void (*SSL_CTX_set_tlsext_servername_callback)( int (*)(const SSL *, int *, void *)) = NULL; #endif +#ifdef SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB +static const long Cryptography_HAS_TLSEXT_STATUS_REQ_CB = 1; +#else +static const long Cryptography_HAS_TLSEXT_STATUS_REQ_CB = 0; +long (*SSL_CTX_set_tlsext_status_cb)(SSL_CTX *, int(*)(SSL *, void *)) = NULL; +#endif + +#ifdef SSL_CTRL_SET_TLSEXT_STATUS_REQ_OCSP_RESP +static const long Cryptography_HAS_STATUS_REQ_OCSP_RESP = 1; +#else +static const long Cryptography_HAS_STATUS_REQ_OCSP_RESP = 0; +long (*SSL_set_tlsext_status_ocsp_resp)(SSL *, unsigned char *, int) = NULL; +#endif + #ifdef SSL_MODE_RELEASE_BUFFERS static const long Cryptography_HAS_RELEASE_BUFFERS = 1; #else @@ -588,6 +611,14 @@ CONDITIONAL_NAMES = { "SSL_CTX_set_tlsext_servername_callback", ], + "Cryptography_HAS_TLSEXT_STATUS_REQ_CB": [ + "SSL_CTX_set_tlsext_status_cb", + ], + + "Cryptography_HAS_STATUS_REQ_OCSP_RESP": [ + "SSL_set_tlsext_status_ocsp_resp", + ], + "Cryptography_HAS_RELEASE_BUFFERS": [ "SSL_MODE_RELEASE_BUFFERS", ], |