Skip to content

Commit bc84599

Browse files
committed
Address review comments
1 parent b659110 commit bc84599

File tree

5 files changed

+43
-51
lines changed

5 files changed

+43
-51
lines changed

Doc/library/ssl.rst

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1300,16 +1300,16 @@ SSL sockets also have the following additional methods and attributes:
13001300
.. method:: SSLSocket.client_sigalg()
13011301

13021302
Return the signature algorithm used for performing certificate-based client
1303-
authentication on this connection. If no connection has been established
1304-
or client authentication didn't occur, this method returns ``None``.
1303+
authentication on this connection, or ``None`` if no connection has been
1304+
established or client authentication didn't occur.
13051305

13061306
.. versionadded:: next
13071307

13081308
.. method:: SSLSocket.server_sigalg()
13091309

13101310
Return the signature algorithm used by the server to complete the TLS
1311-
handshake on this connection. If no connection has been established
1312-
or the cipher suite has no signature, this method returns ``None``.
1311+
handshake on this connection, or ``None`` if no connection has been
1312+
established or the cipher suite has no signature.
13131313

13141314
.. versionadded:: next
13151315

Doc/whatsnew/3.15.rst

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -433,7 +433,7 @@ ssl
433433
connection is made.
434434
(Contributed by Ron Frederick in :gh:`137197`.)
435435

436-
* Added new methods for managing signature algorithms
436+
* Added new methods for managing signature algorithms:
437437

438438
* :meth:`ssl.SSLContext.set_client_sigalgs` sets the signature algorithms
439439
allowed for certificate-based client authentication.

Lib/test/test_ssl.py

Lines changed: 14 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -999,7 +999,7 @@ def test_get_groups(self):
999999
self.assertIn('P-256', ctx.get_groups(include_aliases=True))
10001000

10011001
@unittest.skipUnless(CAN_SET_CLIENT_SIGALGS,
1002-
"AWS-LC doesn't support setting client sigalgs")
1002+
"SSL library doesn't support setting client sigalgs")
10031003
def test_set_client_sigalgs(self):
10041004
ctx = ssl.create_default_context()
10051005

@@ -4311,7 +4311,7 @@ def test_groups(self):
43114311
sni_name=hostname)
43124312

43134313
@unittest.skipUnless(CAN_SET_CLIENT_SIGALGS,
4314-
"AWS-LC doesn't support setting client sigalgs")
4314+
"SSL library doesn't support setting client sigalgs")
43154315
def test_client_sigalgs(self):
43164316
# no mutual auth, so cient_sigalg should be None
43174317
client_context, server_context, hostname = testing_context()
@@ -4322,16 +4322,19 @@ def test_client_sigalgs(self):
43224322
self.assertIsNone(stats['client_sigalg'])
43234323

43244324
# server auto, client rsa_pss_rsae_sha384
4325+
sigalg = "rsa_pss_rsae_sha384"
43254326
client_context, server_context, hostname = \
43264327
testing_context(client_cert=SIGNED_CERTFILE)
4327-
client_context.set_client_sigalgs("rsa_pss_rsae_sha384")
4328+
client_context.set_client_sigalgs(sigalg)
43284329
stats = server_params_test(client_context, server_context,
43294330
chatty=True, connectionchatty=True,
43304331
sni_name=hostname)
43314332
if CAN_GET_SELECTED_OPENSSL_SIGALG:
4332-
self.assertEqual(stats['client_sigalg'], "rsa_pss_rsae_sha384")
4333+
self.assertEqual(stats['client_sigalg'], sigalg)
43334334

4334-
# server / client sigalg mismatch
4335+
@unittest.skipUnless(CAN_SET_CLIENT_SIGALGS,
4336+
"SSL library doesn't support setting client sigalgs")
4337+
def test_client_sigalgs_mismatch(self):
43354338
client_context, server_context, hostname = \
43364339
testing_context(client_cert=SIGNED_CERTFILE)
43374340
client_context.set_client_sigalgs("rsa_pss_rsae_sha256")
@@ -4345,24 +4348,25 @@ def test_client_sigalgs(self):
43454348

43464349
def test_server_sigalgs(self):
43474350
# server rsa_pss_rsae_sha384, client auto
4351+
sigalg = "rsa_pss_rsae_sha384"
43484352
client_context, server_context, hostname = testing_context()
4349-
server_context.set_server_sigalgs("rsa_pss_rsae_sha384")
4353+
server_context.set_server_sigalgs(sigalg)
43504354
stats = server_params_test(client_context, server_context,
43514355
chatty=True, connectionchatty=True,
43524356
sni_name=hostname)
43534357
if CAN_GET_SELECTED_OPENSSL_SIGALG:
4354-
self.assertEqual(stats['server_sigalg'], "rsa_pss_rsae_sha384")
4358+
self.assertEqual(stats['server_sigalg'], sigalg)
43554359

43564360
# server auto, client rsa_pss_rsae_sha384
43574361
client_context, server_context, hostname = testing_context()
4358-
client_context.set_server_sigalgs("rsa_pss_rsae_sha384")
4362+
client_context.set_server_sigalgs(sigalg)
43594363
stats = server_params_test(client_context, server_context,
43604364
chatty=True, connectionchatty=True,
43614365
sni_name=hostname)
43624366
if CAN_GET_SELECTED_OPENSSL_SIGALG:
4363-
self.assertEqual(stats['server_sigalg'], "rsa_pss_rsae_sha384")
4367+
self.assertEqual(stats['server_sigalg'], sigalg)
43644368

4365-
# server / client sigalg mismatch
4369+
def test_server_sigalgs_mismatch(self):
43664370
client_context, server_context, hostname = testing_context()
43674371
client_context.set_server_sigalgs("rsa_pss_rsae_sha256")
43684372
server_context.set_server_sigalgs("rsa_pss_rsae_sha384")
Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,4 @@
1-
:class:`~ssl.SSLContext` objects can now set client and server TLS signature algorithms and
2-
:class:`~ssl.SSLSocket` objects can return the signature algorithms selected on a connection
1+
:mod:`ssl`: :class:`~ssl.SSLContext` objects can now set client and server
2+
TLS signature algorithms. If Python has been built with OpenSSL 3.5 or later,
3+
:class:`~ssl.SSLSocket` objects can return the signature algorithms selected
4+
on a connection.

Modules/_ssl.c

Lines changed: 20 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -2200,30 +2200,24 @@ _ssl__SSLSocket_group_impl(PySSLSocket *self)
22002200
#endif
22012201
}
22022202

2203-
/*[clinic input]
2204-
@critical_section
2205-
_ssl._SSLSocket.client_sigalg
2206-
[clinic start generated code]*/
2207-
22082203
static PyObject *
2209-
_ssl__SSLSocket_client_sigalg_impl(PySSLSocket *self)
2210-
/*[clinic end generated code: output=499dd7fbf021a47b input=a0d9696b5414c627]*/
2204+
ssl_socket_signame_impl(PySSLSocket *socket,
2205+
enum py_ssl_server_or_client self_socket_type)
22112206
{
22122207
#if OPENSSL_VERSION_NUMBER >= 0x30500000L
22132208
int ret;
22142209
const char *sigalg;
22152210

2216-
if (self->ssl == NULL) {
2211+
if (socket->ssl == NULL) {
22172212
Py_RETURN_NONE;
22182213
}
2219-
if (self->socket_type == PY_SSL_CLIENT) {
2220-
ret = SSL_get0_signature_name(self->ssl, &sigalg);
2221-
} else {
2222-
ret = SSL_get0_peer_signature_name(self->ssl, &sigalg);
2223-
}
2214+
ret = (socket->socket_type == self_socket_type)
2215+
? SSL_get0_signature_name(socket->ssl, &sigalg)
2216+
: SSL_get0_peer_signature_name(socket->ssl, &sigalg);
22242217
if (ret == 0) {
22252218
Py_RETURN_NONE;
22262219
}
2220+
assert(sigalg != NULL);
22272221
return PyUnicode_DecodeFSDefault(sigalg);
22282222
#else
22292223
PyErr_SetString(PyExc_NotImplementedError,
@@ -2232,6 +2226,18 @@ _ssl__SSLSocket_client_sigalg_impl(PySSLSocket *self)
22322226
#endif
22332227
}
22342228

2229+
/*[clinic input]
2230+
@critical_section
2231+
_ssl._SSLSocket.client_sigalg
2232+
[clinic start generated code]*/
2233+
2234+
static PyObject *
2235+
_ssl__SSLSocket_client_sigalg_impl(PySSLSocket *self)
2236+
/*[clinic end generated code: output=499dd7fbf021a47b input=a0d9696b5414c627]*/
2237+
{
2238+
return ssl_socket_signame_impl(self, PY_SSL_CLIENT);
2239+
}
2240+
22352241
/*[clinic input]
22362242
@critical_section
22372243
_ssl._SSLSocket.server_sigalg
@@ -2241,27 +2247,7 @@ static PyObject *
22412247
_ssl__SSLSocket_server_sigalg_impl(PySSLSocket *self)
22422248
/*[clinic end generated code: output=c508a766a8e275dc input=9063e562a1e6b946]*/
22432249
{
2244-
#if OPENSSL_VERSION_NUMBER >= 0x30500000L
2245-
int ret;
2246-
const char *sigalg;
2247-
2248-
if (self->ssl == NULL) {
2249-
Py_RETURN_NONE;
2250-
}
2251-
if (self->socket_type == PY_SSL_CLIENT) {
2252-
ret = SSL_get0_peer_signature_name(self->ssl, &sigalg);
2253-
} else {
2254-
ret = SSL_get0_signature_name(self->ssl, &sigalg);
2255-
}
2256-
if (ret == 0) {
2257-
Py_RETURN_NONE;
2258-
}
2259-
return PyUnicode_DecodeFSDefault(sigalg);
2260-
#else
2261-
PyErr_SetString(PyExc_NotImplementedError,
2262-
"Getting sig algorithms requires OpenSSL 3.5 or later.");
2263-
return NULL;
2264-
#endif
2250+
return ssl_socket_signame_impl(self, PY_SSL_SERVER);
22652251
}
22662252

22672253
/*[clinic input]

0 commit comments

Comments
 (0)