pyOpenSSL

Merge lp://staging/~exarkun/pyopenssl/tlsv1_1or2 into lp://staging/~exarkun/pyopenssl/trunk

tlsv1_1or2
Merge into trunk

Proposed by Jean-Paul Calderone on 2013-10-04

Status:

Merged

Merged at revision:

171

Proposed branch:

lp://staging/~exarkun/pyopenssl/tlsv1_1or2

Merge into:

lp://staging/~exarkun/pyopenssl/trunk

Diff against target:

275 lines (+109/-29)

5 files modified

OpenSSL/ssl/context.c (+29/-5)
OpenSSL/ssl/context.h (+2/-0)
OpenSSL/ssl/ssl.c (+8/-0)
OpenSSL/test/test_ssl.py (+24/-11)
doc/api/ssl.rst (+46/-13)

To merge this branch:

bzr merge lp://staging/~exarkun/pyopenssl/tlsv1_1or2

Medium

Fix Committed

Link a bug report

Reviewer	Review Type	Date Requested	Status
Jean-Paul Calderone			Pending
Review via email: mp+189401@code.staging.launchpad.net

Description of the change

Introduces conditional support for TLSv1.1 and TLSv1.2 (conditional on whether the wrapped version of OpenSSL supports them).

lp://staging/~exarkun/pyopenssl/tlsv1_1or2 updated on 2013-10-04

172. By Jean-Paul Calderone on 2013-10-04: Oops.

Revision history for this message

Zooko Wilcox-O'Hearn (zooko) wrote on 2013-10-05:

I don't understand this code very well, but this looks suspicious:

18 +#ifdef SSL_OP_NO_TLSv1_1
19 +#define TLSv1_2_METHOD_TEXT " TLSv1_2_METHOD"
20 +#endif

Shouldn't it be SSL_OP_NO_TLSv1_2 instead? And if so, and this is a bug, does this mean there isn't an automated test that tries to build pyOpenSSL against some version of OpenSSL that has or doesn't have the #defines necessary to trigger this bug?

Revision history for this message

Jean-Paul Calderone (exarkun) wrote on 2013-10-05:

> Shouldn't it be SSL_OP_NO_TLSv1_2 instead?

Almost certainly. Although I don't know whether there are versions of OpenSSL that define one of these (SSL_OP_NO_TLSv1_1, SSL_OP_NO_TLSv1_2) but not the other - so I don't know what the real world consequences of this bug (now fixed) would be.

> does this mean there isn't an automated test that tries to build pyOpenSSL against some version of OpenSSL that has or doesn't have the #defines necessary to trigger this bug?

Yes.