Skip to main content

The ssl.match_hostname() function from Python 3.5

Project description


The ssl.match_hostname() function from Python 3.7
=================================================

The Secure Sockets Layer is only actually *secure*
if you check the hostname in the certificate returned
by the server to which you are connecting,
and verify that it matches to hostname
that you are trying to reach.

But the matching logic, defined in `RFC2818`_,
can be a bit tricky to implement on your own.
So the ``ssl`` package in the Standard Library of Python 3.2
and greater now includes a ``match_hostname()`` function
for performing this check instead of requiring every application
to implement the check separately.

This backport brings ``match_hostname()`` to users
of earlier versions of Python.
Simply make this distribution a dependency of your package,
and then use it like this::

from backports.ssl_match_hostname import match_hostname, CertificateError
[...]
sslsock = ssl.wrap_socket(sock, ssl_version=ssl.PROTOCOL_SSLv23,
cert_reqs=ssl.CERT_REQUIRED, ca_certs=...)
try:
match_hostname(sslsock.getpeercert(), hostname)
except CertificateError, ce:
...

Brandon Craig Rhodes is merely the packager of this distribution;
the actual code inside comes from Python 3.7 with small changes for
portability.


Requirements
------------

* If you need to use this on Python versions earlier than 2.6 you will need to
install the `ssl module`_. From Python 2.6 upwards ``ssl`` is included in
the Python Standard Library so you do not need to install it separately.

.. _`ssl module`:: https://pypi-hypernode.com/pypi/ssl

History
-------

* This function was introduced in python-3.2
* It was updated for python-3.4a1 for a CVE
(backports-ssl_match_hostname-3.4.0.1)
* It was updated from RFC2818 to RFC 6125 compliance in order to fix another
security flaw for python-3.3.3 and python-3.4a5
(backports-ssl_match_hostname-3.4.0.2)
* It was updated in python-3.5 to handle IPAddresses in ServerAltName fields
(something that backports.ssl_match_hostname will do if you also install the
ipaddress library from pypi).
* It was updated in python-3.7 to handle IPAddresses without the ipaddress library and dropped
support for partial wildcards

.. _`ipaddress module`:: https://pypi-hypernode.com/pypi/ipaddress

.. _RFC2818: http://tools.ietf.org/html/rfc2818.html

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

backports.ssl_match_hostname-3.7.0.1.tar.gz (5.7 kB view details)

Uploaded Source

File details

Details for the file backports.ssl_match_hostname-3.7.0.1.tar.gz.

File metadata

File hashes

Hashes for backports.ssl_match_hostname-3.7.0.1.tar.gz
Algorithm Hash digest
SHA256 bb82e60f9fbf4c080eabd957c39f0641f0fc247d9a16e31e26d594d8f42b9fd2
MD5 32d2f593af01a046bec3d2f5181a420a
BLAKE2b-256 ff2b8265224812912bc5b7a607c44bf7b027554e1b9775e9ee0de8032e3de4b2

See more details on using hashes here.

Supported by

AWS AWS Cloud computing and Security Sponsor Datadog Datadog Monitoring Fastly Fastly CDN Google Google Download Analytics Microsoft Microsoft PSF Sponsor Pingdom Pingdom Monitoring Sentry Sentry Error logging StatusPage StatusPage Status page