search

python-hyper / hyper

HTTP/2 for Python.
http://hyper.rtfd.org/en/latest/
MIT License
1.05k stars 192 forks source link

Cipher Checking #64

Open Lukasa opened 10 years ago

Lukasa commented 10 years ago

Setting ourselves to a really restricted cipher list as mandated by the specification breaks on Ubuntu 12.04 because Ubuntu are fucking terrible. I've spent all of yesterday trying to fix this and come up blank, so I'm going to take a new option:

  1. Add a HTTP20Connection property called 'strict TLS' (or similar), defaulting to True.
  2. In HTTP20Connection.connect(), if that parameter is True, check the selected cipher.

Unfortunately, I can't do this yet because PyOpenSSL doesn't support checking the used cipher until 0.15, which isn't out yet. Sigh.

Lukasa commented 10 years ago

I think this approach is OK because client cipher suites aren't authoritative anyway, the server makes the choice, so all I can really do is ensure that the server made a good choice.

Lukasa commented 9 years ago

I'm unblocking this because I think PyOpenSSL is basically dead now.