Still need to support hostname verification
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 944
- Forks
- 440
- Avg merge
- 1d 6h
- Merged PRs (30d)
- 6
Description
It looks like #795 got closed prematurely. #933 made it so that you can skip setting a verify callback, and use OpenSSL's built-in verification functionality. And OpenSSL's built-in verification functionality can now verify hostnames properly on all supported OpenSSL versions. But..... you still have to turn this feature on. And pyopenssl still doesn't expose the APIs to do that. So something like #796 is still needed.
References:
- https://wiki.openssl.org/index.php/Hostname_validation
- https://www.openssl.org/docs/man1.1.0/man3/SSL_set1_host.html
- https://www.openssl.org/docs/man1.1.0/man3/X509_check_host.html
- https://www.openssl.org/docs/man1.1.0/man3/X509_VERIFY_PARAM_set1_ip.html
- https://github.com/python/cpython/blob/ba251c2ae6654bfc8abd9d886b219698ad34ac3c/Modules/_ssl.c#L862-L926
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading the OpenSSL hostname-validation references and the cited CPython Modules/_ssl.c lines 862-926, then compare the missing functionality with pyopenssl's current APIs. The work is complete when pyopenssl exposes the OpenSSL hostname and IP verification controls described in the issue, with appropriate coverage for supported OpenSSL versions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- networking, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100