Skip to content

Commit 80a3e9a

Browse files
committed
Expose set_groups/set_curves functions
This allows pyOpenSSL to restrict the groups allowed to be used. E.g. for restricting the groups to post-quantum hybrid groups (e.g. X25519MLKEM768) to always ensure that post-quantum cryptography is used. This commit uses the set_curves instead of the set_groups variant since that naming is available on all OpenSSL versions and forks. Signed-off-by: Arne Schwabe <arne@rfc2549.org>
1 parent 122e791 commit 80a3e9a

File tree

1 file changed

+7
-0
lines changed

1 file changed

+7
-0
lines changed

src/_cffi_src/openssl/ssl.py

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -346,6 +346,13 @@
346346
347347
const char *SSL_get0_group_name(SSL *);
348348
349+
/* both functions are have int return type according to the man page but
350+
* long in its implementation. Newer versions also have the set1_groups
351+
* function but the curves variants are availalbe on all forks and OpenSSL
352+
* variants */
353+
long SSL_CTX_set1_curves_list(SSL_CTX *, char *);
354+
long SSL_set1_curves_list(SSL *, char *);
355+
349356
void SSL_set_tlsext_host_name(SSL *, char *);
350357
void SSL_CTX_set_tlsext_servername_callback(
351358
SSL_CTX *,

0 commit comments

Comments
 (0)