diff --git a/src/OpenSSL/SSL.py b/src/OpenSSL/SSL.py index 5cf39c0d9..6117ec500 100644 --- a/src/OpenSSL/SSL.py +++ b/src/OpenSSL/SSL.py @@ -665,6 +665,12 @@ def explode(*args, **kwargs): ) +_requires_x509_verify = _make_requires( + _lib.Cryptography_HAS_102_VERIFICATION_PARAMS, + "X509 verification not available" +) + + class Session(object): """ A class representing an SSL session. A session defines certain connection @@ -1688,6 +1694,17 @@ def set_tlsext_host_name(self, name): # XXX I guess this can fail sometimes? _lib.SSL_set_tlsext_host_name(self._ssl, name) + @_requires_x509_verify + def set_verify_host_name(self, hostname): + param = _lib.SSL_get0_param(self._ssl) + flags = _lib.X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS + if _lib.Cryptography_HAS_110_VERIFICATION_PARAMS: + flags |= _lib.X509_CHECK_FLAG_NEVER_CHECK_SUBJECT + _lib.X509_VERIFY_PARAM_set_hostflags(param, flags) + if not _lib.X509_VERIFY_PARAM_set1_host(param, hostname, + len(hostname)): + raise Error("X509_VERIFY_PARAM_set1_host call failed") + def pending(self): """ Get the number of bytes that can be safely read from the SSL buffer